Edit tour

Windows Analysis Report
arrival notice.exe

Overview

General Information

Sample name:	arrival notice.exe
Analysis ID:	1466048
MD5:	3ed45724ae4635f06eb3be7ca4fe97af
SHA1:	f255198b567d8aee91f08335760e06db43de42aa
SHA256:	ce69c0e4efa80c87b672f5fe7ec35808b24d05a1feffba954720e8a801a8acac
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AgentTesla

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Installs a global keyboard hook

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

arrival notice.exe (PID: 6552 cmdline: "C:\Users\user\Desktop\arrival notice.exe" MD5: 3ED45724AE4635F06EB3BE7CA4FE97AF)

RegSvcs.exe (PID: 6616 cmdline: "C:\Users\user\Desktop\arrival notice.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.mahesh-ent.com", "Username": "info@mahesh-ent.com", "Password": "M@hesh3981"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1649097610.0000000000B10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1649097610.0000000000B10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1649097610.0000000000B10000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33e6d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33edf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33f69:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33ffb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34065:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x340d7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3416d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x341fd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000001.00000002.4110380759.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4110380759.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4111551921.0000000002E71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4111551921.0000000002E71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: arrival notice.exe PID: 6552	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: arrival notice.exe PID: 6552	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 6616	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 6616	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33e6d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33edf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33f69:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33ffb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34065:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x340d7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3416d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x341fd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.arrival notice.exe.b10000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.arrival notice.exe.b10000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.arrival notice.exe.b10000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3206d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x320df:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32169:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x321fb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32265:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x322d7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3236d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x323fd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.arrival notice.exe.b10000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.arrival notice.exe.b10000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.arrival notice.exe.b10000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33e6d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33edf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33f69:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33ffb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34065:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x340d7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3416d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x341fd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 148.66.136.151, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 6616, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Snort Signatures

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:19:43.921924
SID:	2840032
Source Port:	58453
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:19:32.752876
SID:	2851779
Source Port:	58452
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:16:00.574256
SID:	2840032
Source Port:	49731
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:18:08.376508
SID:	2855542
Source Port:	58443
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:18:38.860424
SID:	2840032
Source Port:	58447
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:18:38.860181
SID:	2030171
Source Port:	58447
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:19:43.919056
SID:	2030171
Source Port:	58453
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:16:00.574200
SID:	2030171
Source Port:	49731
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:17:50.363623
SID:	2030171
Source Port:	58441
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:18:08.376543
SID:	2840032
Source Port:	58443
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:17:50.363642
SID:	2855542
Source Port:	58441
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:19:43.919056
SID:	2851779
Source Port:	58453
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:18:08.376466
SID:	2030171
Source Port:	58443
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:18:38.860321
SID:	2851779
Source Port:	58447
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:16:00.574256
SID:	2851779
Source Port:	49731
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:17:50.363686
SID:	2840032
Source Port:	58441
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:19:32.752837
SID:	2030171
Source Port:	58452
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:19:32.752876
SID:	2855542
Source Port:	58452
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:16:00.574256
SID:	2855542
Source Port:	49731
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Exfil via SMTP - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:16:00.574256
SID:	2855245
Source Port:	49731
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:18:08.376508
SID:	2851779
Source Port:	58443
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:19:43.919056
SID:	2855542
Source Port:	58453
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:18:38.860321
SID:	2855542
Source Port:	58447
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:19:32.752963
SID:	2840032
Source Port:	58452
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	07/02/24-13:17:50.363642
SID:	2851779
Source Port:	58441
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.2.RegSvcs.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.mahesh-ent.com", "Username": "info@mahesh-ent.com", "Password": "M@hesh3981"}

Multi AV Scanner detection for submitted file

Source: arrival notice.exe

ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: arrival notice.exe

Joe Sandbox ML: detected

Source: arrival notice.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49730 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: arrival notice.exe, 00000000.00000003.1647838419.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, arrival notice.exe, 00000000.00000003.1647947568.0000000003C00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: arrival notice.exe, 00000000.00000003.1647838419.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, arrival notice.exe, 00000000.00000003.1647947568.0000000003C00000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A34696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00A34696
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A3C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00A3C9C7
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A3C93C FindFirstFileW,FindClose,	0_2_00A3C93C
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A3F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A3F200
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A3F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A3F35D
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A3F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00A3F65E
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A33A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A33A2B
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A33D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A33D4E
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A3BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00A3BF27

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.4:49731 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2855245 ETPRO TROJAN Agent Tesla Exfil via SMTP 192.168.2.4:49731 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.4:49731 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.4:49731 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:49731 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.4:58441 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.4:58441 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.4:58441 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:58441 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.4:58443 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.4:58443 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.4:58443 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:58443 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.4:58447 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.4:58447 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.4:58447 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:58447 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.4:58452 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.4:58452 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.4:58452 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:58452 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.4:58453 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.4:58453 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.4:58453 -> 148.66.136.151:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:58453 -> 148.66.136.151:587

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 148.66.136.151:587

Source: Joe Sandbox View	IP Address: 148.66.136.151 148.66.136.151
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 148.66.136.151:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A425E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00A425E2

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.mahesh-ent.com
Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: RegSvcs.exe, 00000001.00000002.4111551921.00000000032A6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111551921.0000000003202000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111551921.000000000303A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111551921.000000000307F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111551921.000000000319A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111551921.0000000003346000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111551921.0000000002F2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.mahesh-ent.com
Source: RegSvcs.exe, 00000001.00000002.4111551921.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: arrival notice.exe, 00000000.00000002.1649097610.0000000000B10000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4110380759.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: arrival notice.exe, 00000000.00000002.1649097610.0000000000B10000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4110380759.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111551921.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000001.00000002.4111551921.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000001.00000002.4111551921.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49730 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.arrival notice.exe.b10000.1.raw.unpack, 3DlgK9re6m.cs

.Net Code: S8rY0

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Jump to behavior

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A4425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00A4425A

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A44458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00A44458

Source: C:\Users\user\Desktop\arrival notice.exe

0_2_00A4425A

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A30219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00A30219

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A5CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00A5CDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.arrival notice.exe.b10000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.arrival notice.exe.b10000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1649097610.0000000000B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\arrival notice.exe	Code function: This is a third-party compiled AutoIt script.	0_2_009D3B4C
Source: arrival notice.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: arrival notice.exe, 00000000.00000000.1638384806.0000000000A85000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_fad4c517-e
Source: arrival notice.exe, 00000000.00000000.1638384806.0000000000A85000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_c48fb060-f
Source: arrival notice.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_fd728e47-f
Source: arrival notice.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_9ea89eeb-f

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: arrival notice.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A340B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,

0_2_00A340B1

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A28858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00A28858

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A3545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00A3545F

Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009DE800	0_2_009DE800
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009FDBB5	0_2_009FDBB5
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A5804A	0_2_00A5804A
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009DE060	0_2_009DE060
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009E4140	0_2_009E4140
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009F2405	0_2_009F2405
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A06522	0_2_00A06522
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A50665	0_2_00A50665
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A0267E	0_2_00A0267E
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009F283A	0_2_009F283A
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009E6843	0_2_009E6843
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A089DF	0_2_00A089DF
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A06A94	0_2_00A06A94
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A50AE2	0_2_00A50AE2
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009E8A0E	0_2_009E8A0E
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A2EB07	0_2_00A2EB07
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A38B13	0_2_00A38B13
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009FCD61	0_2_009FCD61
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A07006	0_2_00A07006
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009E3190	0_2_009E3190
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009E710E	0_2_009E710E
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009D1287	0_2_009D1287
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009F33C7	0_2_009F33C7
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009FF419	0_2_009FF419
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009E5680	0_2_009E5680
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009F16C4	0_2_009F16C4
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009F78D3	0_2_009F78D3
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009E58C0	0_2_009E58C0
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009F1BB8	0_2_009F1BB8
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A09D05	0_2_00A09D05
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009DFE40	0_2_009DFE40
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009F1FD0	0_2_009F1FD0
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009FBFE6	0_2_009FBFE6
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009935F0	0_2_009935F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02DCE2B8	1_2_02DCE2B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02DC41D0	1_2_02DC41D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02DC4AA0	1_2_02DC4AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02DC3E88	1_2_02DC3E88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02DCA980	1_2_02DCA980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_068F5588	1_2_068F5588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_068F65D0	1_2_068F65D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_068F7D58	1_2_068F7D58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_068FB203	1_2_068FB203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_068F3040	1_2_068F3040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_068FC158	1_2_068FC158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_068F7678	1_2_068F7678
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_068F5CBB	1_2_068F5CBB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_068FE380	1_2_068FE380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_068F2338	1_2_068F2338
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_068F0040	1_2_068F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_068F0039	1_2_068F0039
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_068F0031	1_2_068F0031

Source: C:\Users\user\Desktop\arrival notice.exe	Code function: String function: 009F8B40 appears 42 times
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: String function: 009F0D27 appears 70 times
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: String function: 009D7F41 appears 35 times

Source: arrival notice.exe, 00000000.00000002.1649097610.0000000000B10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefcc0edeb-3644-44a7-8b6d-3364cecb7337.exe4 vs arrival notice.exe
Source: arrival notice.exe, 00000000.00000003.1646795521.0000000003B83000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs arrival notice.exe
Source: arrival notice.exe, 00000000.00000003.1648330544.0000000003D2D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs arrival notice.exe

Source: arrival notice.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.arrival notice.exe.b10000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.arrival notice.exe.b10000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1649097610.0000000000B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.arrival notice.exe.b10000.1.raw.unpack, slKb.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.arrival notice.exe.b10000.1.raw.unpack, mAKJ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.arrival notice.exe.b10000.1.raw.unpack, xQRSe0Fg.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.arrival notice.exe.b10000.1.raw.unpack, n3rhMa.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.arrival notice.exe.b10000.1.raw.unpack, MQzE4FWn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.arrival notice.exe.b10000.1.raw.unpack, nSmgRyX5a1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.arrival notice.exe.b10000.1.raw.unpack, 6IMLmJtk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.arrival notice.exe.b10000.1.raw.unpack, 6IMLmJtk.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.arrival notice.exe.b10000.1.raw.unpack, 3HroK7qN.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.arrival notice.exe.b10000.1.raw.unpack, 3HroK7qN.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@4/2

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A3A2D5 GetLastError,FormatMessageW,

0_2_00A3A2D5

Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A28713 AdjustTokenPrivileges,CloseHandle,		0_2_00A28713
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A28CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00A28CC3

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A3B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00A3B59E

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A4F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00A4F121

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A486D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00A486D0

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_009D4FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_009D4FE9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\arrival notice.exe

File created: C:\Users\user\AppData\Local\Temp\aut8EEC.tmp

Jump to behavior

Source: arrival notice.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\arrival notice.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: arrival notice.exe

ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\arrival notice.exe "C:\Users\user\Desktop\arrival notice.exe"
Source: C:\Users\user\Desktop\arrival notice.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\arrival notice.exe"
Source: C:\Users\user\Desktop\arrival notice.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\arrival notice.exe"	Jump to behavior

Source: C:\Users\user\Desktop\arrival notice.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\arrival notice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\arrival notice.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\arrival notice.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\arrival notice.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\arrival notice.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\arrival notice.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\arrival notice.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\arrival notice.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\arrival notice.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\arrival notice.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: arrival notice.exe

Static file information: File size 1267712 > 1048576

Source: arrival notice.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: arrival notice.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: arrival notice.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: arrival notice.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: arrival notice.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: arrival notice.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: arrival notice.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: arrival notice.exe, 00000000.00000003.1647838419.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, arrival notice.exe, 00000000.00000003.1647947568.0000000003C00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: arrival notice.exe, 00000000.00000003.1647838419.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, arrival notice.exe, 00000000.00000003.1647947568.0000000003C00000.00000004.00001000.00020000.00000000.sdmp

Source: arrival notice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: arrival notice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: arrival notice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: arrival notice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: arrival notice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A4C304 LoadLibraryA,GetProcAddress,

0_2_00A4C304

Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A38719 push FFFFFF8Bh; iretd	0_2_00A3871B
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009FE94F push edi; ret	0_2_009FE951
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009FEA68 push esi; ret	0_2_009FEA6A
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009F8B85 push ecx; ret	0_2_009F8B98
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009FEC43 push esi; ret	0_2_009FEC45
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009FED2C push edi; ret	0_2_009FED2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02DC0600 push edx; ret	1_2_02DC061A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02DC0C55 push edi; retf	1_2_02DC0C7A

Source: 0.2.arrival notice.exe.b10000.1.raw.unpack, SMn5.cs

High entropy of concatenated method names: '_8Vimx', 'f7lK', 'uMKvoi6J', 'FWTI9h04fKT', 'OvYNDn1nF7', 'Uc1YsRO0ov', 'qvyIh', 'Q626D', 'VHPMMtos', 'MchLpClTgX'

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (68).png

Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009D4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_009D4A35
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A555FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00A555FD

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_009F33C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_009F33C7

Source: C:\Users\user\Desktop\arrival notice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\arrival notice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\arrival notice.exe

API/Special instruction interceptor: Address: 993214

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2476			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7347			Jump to behavior

Source: C:\Users\user\Desktop\arrival notice.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-101463

Source: C:\Users\user\Desktop\arrival notice.exe

API coverage: 4.7 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A34696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00A34696
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A3C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00A3C9C7
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A3C93C FindFirstFileW,FindClose,	0_2_00A3C93C
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A3F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A3F200
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A3F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A3F35D
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A3F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00A3F65E
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A33A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A33A2B
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A33D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A33D4E
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A3BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00A3BF27

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_009D4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009D4AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97949	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97700	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97483	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97249	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97138	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94591	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94374	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94264	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 93893	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 93713	Jump to behavior

Source: selectee.0.dr	Binary or memory string: PBVmCI
Source: RegSvcs.exe, 00000001.00000002.4114538473.000000000624D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll1

Source: C:\Users\user\Desktop\arrival notice.exe	API call chain: ExitProcess graph end node			graph_0-98701
Source: C:\Users\user\Desktop\arrival notice.exe	API call chain: ExitProcess graph end node			graph_0-98767

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A441FD BlockInput,

0_2_00A441FD

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_009D3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_009D3B4C

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A05CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00A05CCC

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A4C304 LoadLibraryA,GetProcAddress,

0_2_00A4C304

Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00993480 mov eax, dword ptr fs:[00000030h]	0_2_00993480
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009934E0 mov eax, dword ptr fs:[00000030h]	0_2_009934E0
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00991E70 mov eax, dword ptr fs:[00000030h]	0_2_00991E70

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A281F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00A281F7

Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009FA395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_009FA395
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_009FA364 SetUnhandledExceptionFilter,		0_2_009FA364

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\arrival notice.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\arrival notice.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: D5E008

Jump to behavior

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A28C93 LogonUserW,

0_2_00A28C93

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_009D3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_009D3B4C

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_009D4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_009D4A35

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A34EF5 mouse_event,

0_2_00A34EF5

Source: C:\Users\user\Desktop\arrival notice.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\arrival notice.exe"

Jump to behavior

Source: C:\Users\user\Desktop\arrival notice.exe

0_2_00A281F7

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A34C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00A34C03

Source: arrival notice.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: arrival notice.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_009F886B cpuid

0_2_009F886B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A050D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00A050D7

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A12230 GetUserNameW,

0_2_00A12230

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_00A0418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00A0418A

Source: C:\Users\user\Desktop\arrival notice.exe

Code function: 0_2_009D4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009D4AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.arrival notice.exe.b10000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.arrival notice.exe.b10000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1649097610.0000000000B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4110380759.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4111551921.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: arrival notice.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6616, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: arrival notice.exe	Binary or memory string: WIN_81
Source: arrival notice.exe	Binary or memory string: WIN_XP
Source: arrival notice.exe	Binary or memory string: WIN_XPe
Source: arrival notice.exe	Binary or memory string: WIN_VISTA
Source: arrival notice.exe	Binary or memory string: WIN_7
Source: arrival notice.exe	Binary or memory string: WIN_8
Source: arrival notice.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.arrival notice.exe.b10000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.arrival notice.exe.b10000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1649097610.0000000000B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4110380759.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4111551921.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: arrival notice.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6616, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.arrival notice.exe.b10000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.arrival notice.exe.b10000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1649097610.0000000000B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4110380759.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4111551921.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: arrival notice.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6616, type: MEMORYSTR

Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A46596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00A46596
Source: C:\Users\user\Desktop\arrival notice.exe	Code function: 0_2_00A46A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00A46A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	221 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	221 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 Masquerading	LSA Secrets	241 Security Software Discovery	SSH	4 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Valid Accounts	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
arrival notice.exe	68%	ReversingLabs	Win32.Spyware.Negasteal
arrival notice.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://mail.mahesh-ent.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
api.ipify.org	172.67.74.152	true	false	unknown
mail.mahesh-ent.com	148.66.136.151	true	true	unknown
171.39.242.20.in-addr.arpa	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mail.mahesh-ent.com	RegSvcs.exe, 00000001.00000002.4111551921.00000000032A6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111551921.0000000003202000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111551921.000000000303A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111551921.000000000307F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111551921.000000000319A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111551921.0000000003346000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111551921.0000000002F2F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org	arrival notice.exe, 00000000.00000002.1649097610.0000000000B10000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4110380759.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111551921.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	arrival notice.exe, 00000000.00000002.1649097610.0000000000B10000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4110380759.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	RegSvcs.exe, 00000001.00000002.4111551921.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000001.00000002.4111551921.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
148.66.136.151	mail.mahesh-ent.com	Singapore		26496	AS-26496-GO-DADDY-COM-LLCUS	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466048
Start date and time:	2024-07-02 13:15:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	arrival notice.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@4/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 57 Number of non-executed functions: 268
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: arrival notice.exe

Simulations

Behavior and APIs

Time	Type	Description
07:15:55	API Interceptor	9656911x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
148.66.136.151	LOADING ADVICE.exe	Get hash	malicious	AgentTesla	Browse
	SOA.exe	Get hash	malicious	AgentTesla	Browse
	loading advice.exe	Get hash	malicious	AgentTesla	Browse
	loading advice..exe	Get hash	malicious	AgentTesla	Browse
	Order of CTS-SFCS-104.exe	Get hash	malicious	AgentTesla	Browse
	Order of CTS-SFCS-104.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Trojan.PackedNET.2926.9666.23696.exe	Get hash	malicious	AgentTesla	Browse
	SALES CONTRACT (DRAFT).exe	Get hash	malicious	AgentTesla	Browse
	Drawing and specification.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.12840.10064.exe	Get hash	malicious	AgentTesla	Browse
172.67.74.152	242764.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=wef
	K8mzlntJVN.msi	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.mahesh-ent.com	LOADING ADVICE.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	SOA.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	loading advice.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	loading advice..exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	Order of CTS-SFCS-104.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	Order of CTS-SFCS-104.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	SecuriteInfo.com.Trojan.PackedNET.2926.9666.23696.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	SALES CONTRACT (DRAFT).exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	Drawing and specification.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	SecuriteInfo.com.Win32.PWSX-gen.12840.10064.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
api.ipify.org	FmQx1Fw3VA.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	config.lnk.mal.lnk	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	purchase order - PO-011024-201.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	3z5nZg91qJ.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	GuLoader	Browse	172.67.74.152
	DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	GuLoader	Browse	104.26.13.205
	https://pub-4d0a115db8fb4f15a6bf3059fadf5ec9.r2.dev/secure_response.html?user-agent=Mozilla/5.0WindowsNT10.0;Win64;x64AppleWebKit/537.36KHTML,likeGeckoChrome/86.0.4240.75Safari/537.36	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	GkYUK8VCrO.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	PO 4500005168 NIKOLA.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-26496-GO-DADDY-COM-LLCUS	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	GuLoader	Browse	107.180.58.64
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	GuLoader	Browse	107.180.58.64
	16bfcGvz5N.elf	Get hash	malicious	Unknown	Browse	166.62.3.68
	Att0027592.exe	Get hash	malicious	FormBook	Browse	198.12.241.35
	SR9qYL1hLF.elf	Get hash	malicious	Mirai, Moobot	Browse	132.148.33.153
	V7UaNBrX72.elf	Get hash	malicious	Mirai, Moobot	Browse	192.169.229.193
	EGR7RZv5Km.elf	Get hash	malicious	Mirai, Moobot	Browse	50.62.6.1
	sIfZJVVv1H.elf	Get hash	malicious	Mirai, Moobot	Browse	203.124.108.14
	SecuriteInfo.com.Adware.Downware.20552.29919.24444.exe	Get hash	malicious	Unknown	Browse	50.62.141.182
	https://rise.articulate.com/share/vLZgmwdxTzgMOCn_-MA-jGPDyLrctYHZ#/lessons/p6UGeUbHB_wy5dP4j7VOwig0Q_8I9Bvd	Get hash	malicious	HTMLPhisher	Browse	72.167.86.209
CLOUDFLARENETUS	https://www.aspcp.uk	Get hash	malicious	Unknown	Browse	104.16.160.145
	https://scanner.topsec.com/?d=3744&r=auto&u=https%3A%2F%2Fmaknastudio.com%2Fpkyos&t=a4fe2e96fe6815a71cc8a7f1ae1196e6fbcf1f08	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	FmQx1Fw3VA.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	config.lnk.mal.lnk	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	IF10339.pdf.lnk.mal.lnk	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://m.exactag.com/ai.aspx?tc=d9608989bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253APGI.medamax.com.ar/index.xml%23?email=b2xpdmVyLnNjaHVzdGVyQHZvc3Nsb2guY29t	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	email.eml	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	http://url2530.tvsmotor.com/ls/click?upn=u001.smInq0-2BkNc5oRshkzMLE7U6zcio2-2F9zwu1ZIXUanV0NJI-2BOrcqj0f4SCu-2B-2BWZYRJ5WulbQ5i5mBsK1zXEak-2FiMRG64aR-2FUGiDgoHteplEfqii9y-2FZm8OviJTU1sjmz7jpaYlxIO-2FZqsCEMZLobIAuBKqKOl6jqYqSAHVwBkUZuGRzhvuesvLIb-2BOJaFEug0CnemcJJ-2FkU8Glr1M3HQvGDVF8pkc6E-2BTQqwl0-2BRvTDTzQ4xwNmtM8jgWtHhs5lct2mHJvh-2BnfCyHKSgf3QO5YLChbkkZfUthc-2FSlTYRp6ULk4nieUsDKQjQY0ARP1r-2F9grE5R9p-2F4TBXst454YdngqN4csGWrwqWEO-2BJbI3YRp-2Fg-3DkRbc_BoXxesOKw3fVSpVy-2BC2PPQHPKjgFcP87T3onqy0I5SBy6osQQ2xcKyQ69Dfv99zYbpWutixX8bIeidfkYaH4FEzfwCP1XNNT2viTHdTTsqkPAkJDIo2c-2FqiqOAGGJlXcwCsuL3xNAHFNFK3QDwE9v7VlwdAECafqaCNzpVXKcgwAulkP99wOuMpg-2FMtqy-2BF0DGse8UAhz4oSLXx-2FTt4hXQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	purchase order - PO-011024-201.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	http://go.sparkpostmail1.com/f/a/Qy8XDQJtpeYlkqMezh3Eeg~~/AAVXmQA~/RgRnyyJSP0ROaHR0cHM6Ly9pbnN0LmZlYmFmZWRlcmFsYmVuZWZpdHMuY29tL2x0LzExMjU4OTk5MjgxNjc1MTgvcDY2V19yYmFkYk9LaS02NE9GOGJZVwNzcGNCCmXi0u7pZXh5I2VSE2p1ZHkuY2FzdHJvQGJlcC5nb3ZYBAAAAAA~	Get hash	malicious	Unknown	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	invoicepast.pdf.lnk.mal.lnk	Get hash	malicious	ScreenConnect Tool	Browse	172.67.74.152
	Invoice-UPS-218931.pdf.lnk.mal.lnk	Get hash	malicious	Unknown	Browse	172.67.74.152
	IF10339.pdf.lnk.mal.lnk	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://ddec1-0-en-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2faagt%2damx%2dmoodle%2dmex.com%2freport%2finsights%2faction.php%3faction%3duseful%26forwardurl%3dhttps%253A%252F%252Faagt%2damx%2dmoodle%2dmex.com%252Freport%252Finsights%252Fdone.php%253Factionvisiblename%253D%2525C3%25259Atil%2526target%253D%5fblank%26predictionid%3d1580&umid=dfe32622-5afa-43d1-bc88-1d0d19378d86&auth=b37f34d438b54d6822929a8430f2a42f374caac4-c52e46d07bf23779234fc7b6680559fd6de91ad8	Get hash	malicious	Unknown	Browse	172.67.74.152
	http://wiki.hoeron.com/doku.php?id=hoeron:kb:hardware:fortinet:2023-11-29-1701246124	Get hash	malicious	Unknown	Browse	172.67.74.152
	purchase order - PO-011024-201.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://scanner.topsec.com/?d=3744&r=auto&u=https%3A%2F%2Fmaknastudio.com%2Fpkyos&t=a4fe2e96fe6815a71cc8a7f1ae1196e6fbcf1f08	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	https://scanner.topsec.com/?d=3744&r=auto&u=https%3A%2F%2Fmaknastudio.com%2Fpkyos&t=a4fe2e96fe6815a71cc8a7f1ae1196e6fbcf1f08	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	3z5nZg91qJ.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	http://url2530.tvsmotor.com/ls/click?upn=u001.smInq0-2BkNc5oRshkzMLE7U6zcio2-2F9zwu1ZIXUanV0NJI-2BOrcqj0f4SCu-2B-2BWZYRJ5WulbQ5i5mBsK1zXEak-2FiMRG64aR-2FUGiDgoHteplEfqii9y-2FZm8OviJTU1sjmz7jpaYlxIO-2FZqsCEMZLobIAuBKqKOl6jqYqSAHVwBkUZuGRzhvuesvLIb-2BOJaFEug0CxFHH8i5A3U7lzl-2BTzhlR6ei7mav1762I-2BKvT-2Fk6a5kJfjpj9RJPK9q48Ck5mSzSlgwV-2BsscO5sphM5t-2BVSr5yuCYcPokWOxF7VJFLVcuGxe55FXxdx2OWqy1uhpoEHKlprCsCZc7-2FzwTpK7gWkfISgE1dm3DNZag7jRcJoAY96XjRqTOiYZpVCYj4WczYZatXIFKlGImVUX-2BtzacIIXUkQ-3D-3Dxdxc_PRiWw-2BWerOwUL-2FYAA-2FiwxOm-2BJW3ubqhGFJ5iVqhmG217gfj9KgzNOSRNluvFvYbWIHUd-2ByAsKYpybXBhPgqT-2F1WfaNjyxdi-2FNqxuKfkiep8TocNXSydFj2bAYBLtB5MEDItgpH6g-2FV3171HTXrzYHtaSp7MB2B8WILdzxuyybTMsChhP3QdW9m4oU0X1zagLaXiyfnb7qkeR5CYT3FajfA-3D-3D	Get hash	malicious	Unknown	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\arrival notice.exe
File Type:	ASCII text, with very long lines (28756), with no line terminators
Category:	dropped
Size (bytes):	28756
Entropy (8bit):	3.586637471205671
Encrypted:	false
SSDEEP:	768:miTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbd+IH6B34vfF3if6gyCZ:miTZ+2QoioGRk6ZklputwjpjBkCiw2RG
MD5:	92CFC5C15AD8088363A8D66B243AC46E
SHA1:	7E9459170F7129A3DBD7028177973A184A79A563
SHA-256:	FE3B8BAB1CAC58840914D7CBAF4CCDEFD263C1AF028C3AB5939DA16F9D0AFAE1
SHA-512:	6442F5048D4109160204E69CD484BF9742EC2F3AD79C48D3F7BAE63093B23E19503D280178BA3AFCCAD610D3730DA0B89095D16DC9CF0AD6DEC0EC342FB7ED1B
Malicious:	false
Reputation:	low
Preview:	8D6804F867D7E3ED21599F86932DA5673082A29A59B06B261C54E6F1DF089BBB368C973697738FDC880x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffff

C:\Users\user\AppData\Local\Temp\aut8EEC.tmp

Download File

Process:	C:\Users\user\Desktop\arrival notice.exe
File Type:	data
Category:	dropped
Size (bytes):	144770
Entropy (8bit):	7.740899336372646
Encrypted:	false
SSDEEP:	3072:UC6ljmFWtcwseIr+DFkn9nfoeHOiAXTBF4qXTU:UCdapkn93bADBSqA
MD5:	E3CAC147EFF4452CFBD6E7C5F77C88DA
SHA1:	8B48C34622F79BD9649AA61860931ECF923DC30F
SHA-256:	C9200C71438D6EA298DC5F7A996BFFAC33C8EE4B82B34BBCB38D14A4F68A85DC
SHA-512:	3D272D4FE4232D7A2B087DDF5489632B2D6B359DED90EFB7860AE36311E6382D90BEB8429DE02F38C66AEED05C63C988BCB6F2CC1F2BDB5B4D382BFBD42F133D
Malicious:	false
Reputation:	low
Preview:	EA06......x.Z]joP.P..}.6.N.M..Z@.....(3.:p.!........&.U...gn?../...I.4K..u5.H.2...A\.Hi.y...(.O.....}.......W.V.....\..X%niP.Dl....j+SZ.n.\..s.:t.~..v..G.....L.@... ..aP.O.$3T...^.E.V.(1C.D9s....H...4z=.D......k...>. .x<....Qh. .P....@R@.;X..! ...M.S.......h.....T...=a.T%.j,.o+..".p.... L@........V.....e+.Tj....3.T(........@fU.`...........U.Z4U-r.6.T.....H.....3%..7........i.9.6..th..D.....a...GC..4.8..#..`t.j=[.q..)W..[Y....>F.=.Tt...c.h.W&....s..Lvu^.....p...V.J..?.&..Tly........m].$.C...6..[.Omr.U.y5.A$.z..O......e...0.~.F....k3.u../...[..2K(...]......`.Ee.R.`E...p..V..&......../.....@.......8.A....H..w.z^c^.!Yt]+.......+.w...Hs.........hvn.2..)..L.....{..>.c{...........f5J..3../..f.....`....#...{.........Y...9.......t).p...Z..:.............M....uW.....nM5.G.q[..}J.J.p1C..(.J...A.V#.:...m..aT...]P.0*R..^.E...7...9-...;^..0.M.....)T._...j.:..T...Go.U.3.....Q.r....u........Af.....@.C..i..wI._o...^...R.............n.M.TX...F.U..9m.....(u.

C:\Users\user\AppData\Local\Temp\aut8F4B.tmp

Download File

Process:	C:\Users\user\Desktop\arrival notice.exe
File Type:	data
Category:	dropped
Size (bytes):	9806
Entropy (8bit):	7.603110129007482
Encrypted:	false
SSDEEP:	192:65jwEiqEH1WgUJuzJkecGgJo7xocBk2SZQoeQ1POjXb6cJN8dN:I6qEHYV0eecGGo7xocBe5b8XbHe
MD5:	F1205E9FC6CEE975D2EE5C8A87A93907
SHA1:	8C13596E5961526A78D3F01756E2250998577A03
SHA-256:	5D3CE3A24A5728341195DD158007BCCB3BC4B13BBE3E9031314E7B11D339C04F
SHA-512:	6E71F83DA8B5802C56F848AEADB800F15C189D4B1C7455B7F6E44EA0D49FCA7B9DA4D3B5CC82695B8F5E5E10C08FFE473620E7ABB0D1811852364119096246E2
Malicious:	false
Reputation:	low
Preview:	EA06..pT.Q&...8.M.z,.D.Lf....y9......o3.N&T...5...j..m1..f.Y..cD.L'.....3.N(s...m9...s.5..8.L/.Y...e..&6[...0.L..I..k7.N&. ..a0.M.....q4.Nf.P.....K..d.%...p.lY@.......c.Xf.0.o..b.L.`...,@. ...3+..d....s4.l&..........\|....sa...`.........Y&.K0.....-vs5.M..2...N&.I...@.>..........$.0...fx. ..$l...I...#..$6...... ..... .Z...a.5..&.).....L.j.;$....M.j.;$....X@j.;%....Y@j.;,.....j.e.\|f #^...j......l.....l.5....>0..Xf....M.^....$zn.....G..I....C...M.\|........}S{....7...\| l..P..........0...`>;..c7.6..{......=..7..............6,......b...,S ...i5.M.4.b..i\|v)....b.h.,@..%........9....c...\|3Y..h......._......@.>K...,v[..q5.M,.@..i7.X......9....2.......,.`....3.,.i8........}.k(.f..@..M&V....7.,.x....&.......0.......Fh...Fb.....3.."a9...`....,vb.....cd.X..P.Fl.Y.$..c. ....I...d..f.!...,vd......8..P.......0.....2...y...D.......c.0.......b.<NA...NM..;4.X.q1..&@Q..B.Y.ah......Yl.i..."..Bvj.........ic..'3Y..'f.....,j.1........C.`....7b.., .p..T.......Y,Vi......@

C:\Users\user\AppData\Local\Temp\selectee

Download File

Process:	C:\Users\user\Desktop\arrival notice.exe
File Type:	data
Category:	dropped
Size (bytes):	242688
Entropy (8bit):	6.570799154072773
Encrypted:	false
SSDEEP:	6144:0F65OQQUx9PVpijFkpowxi46GOhs6w4LcfKqa3stjSi:0UUQQYZVpijGpowT6GOe6LcZakj5
MD5:	7F5AF8F258D0B927D8084F21B81C83A3
SHA1:	CDE424C833BC60D5861D424E7F2DD2BC0121C49E
SHA-256:	B1F0935FEEEE2B08138E328045170BBAE28C05D981BB78562AF387BDB8A02BEC
SHA-512:	F5144E216F10344FC1EBE4EE0F29A4EE399626EA35B4333C726B8D8235DFA1E40FD86E200DF86B25510A6E0AB312818F943554641D04D632C4B6EAD5D40D8B2F
Malicious:	false
Reputation:	low
Preview:	um.EKZ7PTBWG..PN.7PEHZ7P.BWGA2PN87PEHZ7PPBWGA2PN87PEHZ7PPBWG.2PN6(.KH.>.q.V....&QDp5:5P"1/w$ \>!L.2 h(B>p+9g.}.nUX4 fW:ZtBWGA2PNhrPE.[4P..d!A2PN87PE.Z5Q[C\GA.SN8?PEHZ7P.TGA.PN8.SEHZwPPbWGA0PN<7PEHZ7PTBWGA2PN8.TEHX7PPBWGC2..87@EHJ7PPBGGA"PN87PEXZ7PPBWGA2PN\.SE.Z7PP.TG.7PN87PEHZ7PPBWGA2PN87TEDZ7PPBWGA2PN87PEHZ7PPBWGA2PN87PEHZ7PPBWGA2PN87PEHZ7PPbWGI2PN87PEHZ7PXbWG.2PN87PEHZ7P~62?52PN..SEHz7PP.TGA0PN87PEHZ7PPBWGa2P..E#7+Z7P.GWGA.SN81PEH.4PPBWGA2PN87PE.Z7.~02+.QPN47PEHZ3PP@WGA.SN87PEHZ7PPBWG.2P.87PEHZ7PPBWGA2PN..SEHZ7P.BWGC2UNh.RE\n6PSBWG@2PH87PEHZ7PPBWGA2PN87PEHZ7PPBWGA2PN87PEHZ7PPBWGA2PN%......n.?iM#5.h.P.F..$..;..NsE.C#...:....fGV.q7.Jx...Y...G.F=NQ....h"\6OZ.9.81.U....v3.y.HV....Ib.,Qc.....s...{_$....F..[X=k)G<5l.&'S"'.5.DHZ7P.......QO..eY8NdP/....%(.....BWG%2PNJ7PE)Z7P.BWG.2PNV7PE6Z7P.BWG.2PNx7PE.Z7PuBWG,2PN.7PE6Z7P.?XH..'K..EHZ7Pe..w._..h.r..f!.).#....S....2..M?.6q....^.1{.G.<Ab\|.I91T@J]3S\.Y...o:3T@J]3S\.Y...o...q...!...H.287PEHZ.PP.WGA..N.7PE.Z.P..WGA..N.7.E..P

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.955935024271252
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	arrival notice.exe
File size:	1'267'712 bytes
MD5:	3ed45724ae4635f06eb3be7ca4fe97af
SHA1:	f255198b567d8aee91f08335760e06db43de42aa
SHA256:	ce69c0e4efa80c87b672f5fe7ec35808b24d05a1feffba954720e8a801a8acac
SHA512:	913b44bd57d342355b95b2202986bcd051d8ab10bdf43a1f7ad37954cbb585174500dc9b7daffefa93da059ccc7975d9f5c811a4b41533640da6b2171551fae7
SSDEEP:	24576:KAHnh+eWsN3skA4RV1Hom2KXMmHa0/6nnjqKoeps0okl9M6trQuEba5:dh+ZkldoPK8YaTjqKoepsLTFU
TLSH:	E445AE037780C079FFAB91B35B16E24067BDAC7A8127951F13982A7ABDB05B1163D723
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	73191a131b1f736e

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x668340F6 [Mon Jul 1 23:51:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F276D06F44Dh
jmp 00007F276D062204h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F276D06238Ah
cmp edi, eax
jc 00007F276D0626EEh
bt dword ptr [004C41FCh], 01h
jnc 00007F276D062389h
rep movsb
jmp 00007F276D06269Ch
cmp ecx, 00000080h
jc 00007F276D062554h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F276D062390h
bt dword ptr [004BF324h], 01h
jc 00007F276D062860h
bt dword ptr [004C41FCh], 00000000h
jnc 00007F276D06252Dh
test edi, 00000003h
jne 00007F276D06253Eh
test esi, 00000003h
jne 00007F276D06251Dh
bt edi, 02h
jnc 00007F276D06238Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F276D062393h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F276D0623E5h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x6b18c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x134000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x6b18c	0x6b200	22afbea2bb019bacdf5d8ebdcc6932f2	False	0.6708289272170361	data	7.221288929834148	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x134000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc86c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc87f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc8918	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8a40	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.5671641791044776
RT_ICON	0xc98e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.6624548736462094
RT_ICON	0xca190	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	Great Britain	0.6036866359447005
RT_ICON	0xca858	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.47760115606936415
RT_ICON	0xcadc0	0x64c1	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9930989028030861
RT_ICON	0xd1284	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	Great Britain	0.1848456169407311
RT_ICON	0xe1aac	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	Great Britain	0.3375551818372924
RT_ICON	0xeaf54	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	English	Great Britain	0.34515037593984965
RT_ICON	0xf173c	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	Great Britain	0.3652033271719039
RT_ICON	0xf6bc4	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	Great Britain	0.3302432687765706
RT_ICON	0xfadec	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.49813278008298756
RT_ICON	0xfd394	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.5572232645403377
RT_ICON	0xfe43c	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	Great Britain	0.7163934426229508
RT_ICON	0xfedc4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7562056737588653
RT_MENU	0xff22c	0x50	data	English	Great Britain	0.9
RT_STRING	0xff27c	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xff810	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xffe9c	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0x10032c	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0x100928	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0x100f84	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0x1013ec	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0x101544	0x31674	data			1.000350866789223
RT_GROUP_ICON	0x132bb8	0xca	data	English	Great Britain	0.6683168316831684
RT_GROUP_ICON	0x132c84	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x132c98	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x132cac	0x14	data	English	Great Britain	1.25
RT_VERSION	0x132cc0	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x132d9c	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/02/24-13:19:43.921924	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	58453	587	192.168.2.4	148.66.136.151
07/02/24-13:19:32.752876	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	58452	587	192.168.2.4	148.66.136.151
07/02/24-13:16:00.574256	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49731	587	192.168.2.4	148.66.136.151
07/02/24-13:18:08.376508	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	58443	587	192.168.2.4	148.66.136.151
07/02/24-13:18:38.860424	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	58447	587	192.168.2.4	148.66.136.151
07/02/24-13:18:38.860181	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	58447	587	192.168.2.4	148.66.136.151
07/02/24-13:19:43.919056	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	58453	587	192.168.2.4	148.66.136.151
07/02/24-13:16:00.574200	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49731	587	192.168.2.4	148.66.136.151
07/02/24-13:17:50.363623	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	58441	587	192.168.2.4	148.66.136.151
07/02/24-13:18:08.376543	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	58443	587	192.168.2.4	148.66.136.151
07/02/24-13:17:50.363642	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	58441	587	192.168.2.4	148.66.136.151
07/02/24-13:19:43.919056	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	58453	587	192.168.2.4	148.66.136.151
07/02/24-13:18:08.376466	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	58443	587	192.168.2.4	148.66.136.151
07/02/24-13:18:38.860321	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	58447	587	192.168.2.4	148.66.136.151
07/02/24-13:16:00.574256	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49731	587	192.168.2.4	148.66.136.151
07/02/24-13:17:50.363686	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	58441	587	192.168.2.4	148.66.136.151
07/02/24-13:19:32.752837	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	58452	587	192.168.2.4	148.66.136.151
07/02/24-13:19:32.752876	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	58452	587	192.168.2.4	148.66.136.151
07/02/24-13:16:00.574256	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49731	587	192.168.2.4	148.66.136.151
07/02/24-13:16:00.574256	TCP	2855245	ETPRO TROJAN Agent Tesla Exfil via SMTP	49731	587	192.168.2.4	148.66.136.151
07/02/24-13:18:08.376508	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	58443	587	192.168.2.4	148.66.136.151
07/02/24-13:19:43.919056	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	58453	587	192.168.2.4	148.66.136.151
07/02/24-13:18:38.860321	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	58447	587	192.168.2.4	148.66.136.151
07/02/24-13:19:32.752963	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	58452	587	192.168.2.4	148.66.136.151
07/02/24-13:17:50.363642	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	58441	587	192.168.2.4	148.66.136.151

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 13:15:54.489873886 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 2, 2024 13:15:54.489948988 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 2, 2024 13:15:54.490031004 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 2, 2024 13:15:54.499809980 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 2, 2024 13:15:54.499876022 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 2, 2024 13:15:54.977726936 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 2, 2024 13:15:54.977817059 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 2, 2024 13:15:55.049144983 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 2, 2024 13:15:55.049181938 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 2, 2024 13:15:55.049473047 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 2, 2024 13:15:55.100583076 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 2, 2024 13:15:55.430769920 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 2, 2024 13:15:55.476492882 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 2, 2024 13:15:55.540448904 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 2, 2024 13:15:55.540522099 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 2, 2024 13:15:55.540721893 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 2, 2024 13:15:55.618992090 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 2, 2024 13:15:56.573632002 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:15:56.578532934 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:15:56.578596115 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:15:57.952403069 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:15:57.952622890 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:15:57.957384109 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:15:58.465684891 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:15:58.503066063 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:15:58.507975101 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:15:58.853722095 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:15:58.863758087 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:15:59.099636078 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:15:59.099685907 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:15:59.100871086 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:15:59.462419987 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:15:59.463687897 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:15:59.468487024 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:15:59.812216043 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:15:59.812500000 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:15:59.817234993 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:16:00.224934101 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:16:00.225099087 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:16:00.229882956 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:16:00.573653936 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:16:00.574199915 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:16:00.574255943 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:16:00.574275970 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:16:00.574297905 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:16:00.581527948 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:16:00.581548929 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:16:00.583715916 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:16:00.583726883 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:16:08.508141994 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:16:08.553741932 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:36.569644928 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:36.574438095 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:37.125201941 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:37.125351906 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:37.125349998 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:37.125423908 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:37.132864952 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:47.450650930 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:47.455547094 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:47.455761909 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:48.305284023 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:48.305423975 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:48.310286999 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:48.640779972 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:48.640958071 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:48.645797968 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:48.976320982 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:48.976577997 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:48.981343031 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:49.317924976 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:49.318754911 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:49.323477983 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:49.653537035 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:49.653749943 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:49.658621073 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.026819944 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.026962042 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.031789064 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.362313032 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.363567114 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.363622904 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.363641977 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.363686085 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.365065098 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.368391991 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.368596077 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.368604898 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.368614912 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.368653059 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.369803905 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.369853020 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.369918108 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.369932890 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.369940996 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.369945049 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.369961023 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.369990110 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.370026112 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.370034933 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.370071888 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.370166063 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.370182037 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.370207071 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.370225906 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.373456955 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.373502970 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.374617100 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.374659061 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.374672890 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.374708891 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.374778986 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.374824047 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.374877930 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.374917984 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.374952078 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.374967098 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.374996901 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.375020027 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.375057936 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.375067949 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.375102043 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.375114918 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.375143051 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.375232935 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.375277996 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.378456116 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.378518105 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.379560947 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.379576921 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.379614115 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.379631042 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.379637957 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.379683971 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.379795074 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.379803896 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.379812956 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.379846096 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:50.379884958 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.379940987 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.380006075 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.380033016 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.380048037 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.380147934 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.380156040 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.380162954 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.380171061 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.380178928 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.380187035 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.380194902 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.380202055 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.380255938 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.380264044 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.380271912 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.380279064 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.380285978 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.383301973 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.383413076 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.383455992 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.383464098 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.384469986 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.384478092 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.384491920 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.384502888 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.384510040 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.384541035 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.384550095 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.384557009 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.384563923 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.384583950 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.384593964 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.384601116 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.384609938 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.384660959 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:50.384715080 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:51.305624008 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:51.358813047 CEST	58442	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:51.515002012 CEST	587	58442	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:51.515017986 CEST	587	58441	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:51.515192986 CEST	58441	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:51.515192986 CEST	58442	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:52.429682016 CEST	587	58442	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:52.429975033 CEST	587	58442	148.66.136.151	192.168.2.4
Jul 2, 2024 13:17:52.430020094 CEST	58442	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:52.435740948 CEST	58442	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:17:52.443217039 CEST	587	58442	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:05.217192888 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:05.223448038 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:05.225095034 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:06.133253098 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:06.133519888 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:06.138406038 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:06.483870983 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:06.484155893 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:06.488945961 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:06.890506029 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:06.892909050 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:06.898027897 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:07.258297920 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:07.259251118 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:07.264095068 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:07.613781929 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:07.621807098 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:07.626638889 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.023377895 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.023529053 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.028311014 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.373920918 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.376339912 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.376466036 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.376507998 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.376543045 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.377979994 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.381534100 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.381551027 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.381565094 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.381573915 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.381625891 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.383441925 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.383451939 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.383467913 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.383500099 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.383524895 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.386460066 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.386470079 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.386486053 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.386497974 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.386506081 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.386509895 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.386522055 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.386540890 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.386554956 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.386591911 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.387037039 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.387305975 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.388390064 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.388446093 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.388554096 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.388566017 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.388580084 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.388597965 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.388633013 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.392080069 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.392091036 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.392107964 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.392153025 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.392204046 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.392251968 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.392344952 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.392396927 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.392493010 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.392539978 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.393182039 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.393238068 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.393557072 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.393610954 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.393953085 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.393965006 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.394043922 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.395080090 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.395088911 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.395104885 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.395133018 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.397633076 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.397769928 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.397783041 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.397794008 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.398379087 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.398387909 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.398406029 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.398413897 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.398427963 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.398437023 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.398452997 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.398463964 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.398477077 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.398488998 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.398500919 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.398526907 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.398539066 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.398554087 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.398562908 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.398578882 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.398591995 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.398606062 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.399050951 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.399519920 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.399532080 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.399569988 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.400146008 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.400156021 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.400158882 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.400162935 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.400166035 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.400171041 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.400312901 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.400325060 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:08.400418043 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:08.405615091 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:12.758641958 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:12.786998987 CEST	587	58443	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:12.790812969 CEST	58443	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:12.810648918 CEST	58444	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:12.815666914 CEST	587	58444	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:12.818792105 CEST	58444	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:13.722073078 CEST	587	58444	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:13.722249031 CEST	587	58444	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:13.722300053 CEST	58444	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:13.722439051 CEST	58444	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:13.727185965 CEST	587	58444	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:14.135740042 CEST	58445	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:14.141062975 CEST	587	58445	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:14.141132116 CEST	58445	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:15.044183016 CEST	587	58445	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:15.044446945 CEST	587	58445	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:15.045351028 CEST	58445	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:15.048978090 CEST	58445	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:15.053915024 CEST	587	58445	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:19.274276018 CEST	58446	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:19.279225111 CEST	587	58446	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:19.279321909 CEST	58446	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:20.221935034 CEST	587	58446	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:20.221947908 CEST	587	58446	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:20.221954107 CEST	587	58446	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:20.222022057 CEST	58446	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:20.222040892 CEST	58446	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:20.222210884 CEST	58446	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:20.227098942 CEST	587	58446	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:35.353437901 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:35.358387947 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:35.358452082 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:36.462376118 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:36.462769032 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:36.463644028 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:36.466753006 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:36.467864990 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:36.806294918 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:36.806457996 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:36.811289072 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:37.421561003 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:37.421909094 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:37.421957970 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:37.422003031 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:37.426870108 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:37.774101019 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:37.780750990 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:37.786082983 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.126039028 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.126233101 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.131258965 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.505870104 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.506037951 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.510838985 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.859666109 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.860129118 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.860181093 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.860321045 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.860424042 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.862361908 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.866008997 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.866108894 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.866528034 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.866580009 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.866967916 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.868864059 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.868877888 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.868886948 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.868895054 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.868913889 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.868917942 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.868925095 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.868933916 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.868963957 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.868989944 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.870264053 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.870307922 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.870366096 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.870404005 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.871455908 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.871505976 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.873878002 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.873892069 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.873939037 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.873950005 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.873981953 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.873995066 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.873995066 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.874047995 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.874147892 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.874157906 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.874166012 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.874207020 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.875202894 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.875255108 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.875508070 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.875560999 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.876492023 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.876543045 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.878757000 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.878815889 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.878854990 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.878901005 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.878901958 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.878952980 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.878966093 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.878998041 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.879020929 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:38.879054070 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.879065990 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.879152060 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.879163027 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.879206896 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.879245043 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.879348040 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.879358053 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.879367113 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.879930973 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.880079031 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.880088091 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.880167961 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.880177021 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.880317926 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.881144047 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.881217003 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.881262064 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.881270885 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.881324053 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.883464098 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.883563042 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.883572102 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.883634090 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.883651018 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.883752108 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.883760929 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.883806944 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.883815050 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.883866072 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.883874893 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.883897066 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.883949995 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.883958101 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.883961916 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.884056091 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.884066105 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:38.884073019 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:51.772805929 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:51.778587103 CEST	587	58447	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:51.778672934 CEST	58447	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:51.824908018 CEST	58448	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:52.846410036 CEST	587	58448	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:52.848581076 CEST	58448	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:54.007971048 CEST	587	58448	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:54.008047104 CEST	587	58448	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:54.008086920 CEST	58448	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:54.011223078 CEST	58448	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:54.016046047 CEST	587	58448	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:57.856674910 CEST	58449	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:57.861514091 CEST	587	58449	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:57.862719059 CEST	58449	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:58.731825113 CEST	587	58449	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:58.732001066 CEST	587	58449	148.66.136.151	192.168.2.4
Jul 2, 2024 13:18:58.732099056 CEST	58449	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:58.732168913 CEST	58449	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:18:58.737425089 CEST	587	58449	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:16.342447996 CEST	58450	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:16.347562075 CEST	587	58450	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:16.347773075 CEST	58450	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:17.236152887 CEST	587	58450	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:17.236346006 CEST	58450	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:17.244862080 CEST	587	58450	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:17.571408033 CEST	587	58450	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:17.571569920 CEST	58450	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:17.576387882 CEST	587	58450	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:17.663394928 CEST	58450	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:17.669845104 CEST	587	58450	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:17.669900894 CEST	58450	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:17.725406885 CEST	58451	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:17.731540918 CEST	587	58451	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:17.731610060 CEST	58451	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:18.598768950 CEST	587	58451	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:18.598989010 CEST	587	58451	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:18.600881100 CEST	58451	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:18.604729891 CEST	58451	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:18.609596968 CEST	587	58451	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:25.607757092 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:25.612624884 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:25.614818096 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:26.467442036 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:26.467721939 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:26.472496033 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:26.883757114 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:26.888397932 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:26.893464088 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:31.224323988 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:31.224591970 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:31.229614973 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:31.572490931 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:31.572632074 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:31.577528954 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.038327932 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.038481951 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.043443918 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.411041975 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.411209106 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.415963888 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.752470970 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.752758980 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.752836943 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.752876043 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.752963066 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.754386902 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.765939951 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.765954018 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.765971899 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.766017914 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.767543077 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.767602921 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.767642975 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.767658949 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.767671108 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.767698050 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.767709017 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.767740965 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.767750978 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.767760038 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.767770052 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.767779112 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.767787933 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.767790079 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.767818928 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.767837048 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.773520947 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.773582935 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.773699045 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.773710012 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.773745060 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.773792028 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.773813963 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.773854017 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.774036884 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.774105072 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.774107933 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.774162054 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.774172068 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.774178028 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.774230957 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.774439096 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.774450064 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.774518967 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.778542995 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.778599977 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.778652906 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.778805017 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.778815031 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.778878927 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.778933048 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779042006 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:32.779122114 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779131889 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779196024 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779206038 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779269934 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779341936 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779388905 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779400110 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779407024 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779429913 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779484987 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779556990 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779588938 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779629946 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779678106 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779735088 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779766083 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779818058 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779829025 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.779838085 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.783513069 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.783663034 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.783706903 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.783804893 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.783988953 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.784113884 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.784157991 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.784235001 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.784245014 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.784279108 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.784288883 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.784420013 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.784429073 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.784508944 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.784518957 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.784567118 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.784576893 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.784693003 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:32.784703970 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:40.866597891 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:40.871812105 CEST	587	58452	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:40.871890068 CEST	58452	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:40.929533958 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:40.934462070 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:40.934525013 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:41.822902918 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:41.823021889 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:41.828262091 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:42.162431002 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:42.162698984 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:42.167706013 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:42.502815962 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:42.505227089 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:42.510183096 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:42.856380939 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:42.858834028 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:42.863717079 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.197216034 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.197397947 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.202423096 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.575424910 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.575603962 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.580424070 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.915930033 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.918992996 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.919055939 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.919055939 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.921924114 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.921924114 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.923950911 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.924010992 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.924022913 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.924194098 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.926750898 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.926868916 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.926882029 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.926892996 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.926923037 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.926947117 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.926955938 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.926973104 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.926980019 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.926991940 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.927009106 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.927053928 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.927131891 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.927294970 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.929001093 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.929079056 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.931880951 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.931891918 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.931998014 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.932008028 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.932019949 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.932030916 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.932034016 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.932055950 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.932080984 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.932128906 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.932282925 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.932384968 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.934199095 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.934396029 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.936870098 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.936949968 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937047958 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937108994 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.937151909 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937170982 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.937180996 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.937191963 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937227011 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:19:43.937242985 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937305927 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937385082 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937443972 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937623024 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937633038 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937642097 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937650919 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937669992 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937679052 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937688112 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937705994 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937716007 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937726974 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937752008 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937762022 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937834024 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937844038 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.937853098 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.939250946 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.939265966 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.939276934 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.939357996 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.942096949 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.942109108 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.942118883 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.942136049 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.942145109 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.942154884 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.942226887 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.942244053 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.942275047 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.942336082 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.942346096 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.942354918 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.942373037 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.942384958 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:43.942416906 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:52.599196911 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:19:52.647730112 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:20:01.010708094 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:20:01.016222954 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:20:01.555083036 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:20:01.555119038 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:20:01.555325985 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:20:01.555325985 CEST	58453	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:20:01.555720091 CEST	58454	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:20:01.560173035 CEST	587	58453	148.66.136.151	192.168.2.4
Jul 2, 2024 13:20:01.560467005 CEST	587	58454	148.66.136.151	192.168.2.4
Jul 2, 2024 13:20:01.560587883 CEST	58454	587	192.168.2.4	148.66.136.151
Jul 2, 2024 13:20:02.451948881 CEST	587	58454	148.66.136.151	192.168.2.4
Jul 2, 2024 13:20:02.507090092 CEST	58454	587	192.168.2.4	148.66.136.151

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 13:15:54.476367950 CEST	50510	53	192.168.2.4	1.1.1.1
Jul 2, 2024 13:15:54.485613108 CEST	53	50510	1.1.1.1	192.168.2.4
Jul 2, 2024 13:15:56.552087069 CEST	51177	53	192.168.2.4	1.1.1.1
Jul 2, 2024 13:15:56.573108912 CEST	53	51177	1.1.1.1	192.168.2.4
Jul 2, 2024 13:16:16.128660917 CEST	53	53603	1.1.1.1	192.168.2.4
Jul 2, 2024 13:16:18.108309031 CEST	53	52344	1.1.1.1	192.168.2.4
Jul 2, 2024 13:16:32.639683962 CEST	53	59063	162.159.36.2	192.168.2.4
Jul 2, 2024 13:16:33.126375914 CEST	64297	53	192.168.2.4	1.1.1.1
Jul 2, 2024 13:16:33.146173954 CEST	53	64297	1.1.1.1	192.168.2.4
Jul 2, 2024 13:17:47.414628029 CEST	56237	53	192.168.2.4	1.1.1.1
Jul 2, 2024 13:17:47.448648930 CEST	53	56237	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 2, 2024 13:15:54.476367950 CEST	192.168.2.4	1.1.1.1	0xa052	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jul 2, 2024 13:15:56.552087069 CEST	192.168.2.4	1.1.1.1	0x8914	Standard query (0)	mail.mahesh-ent.com	A (IP address)	IN (0x0001)	false
Jul 2, 2024 13:16:33.126375914 CEST	192.168.2.4	1.1.1.1	0x5f9	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jul 2, 2024 13:17:47.414628029 CEST	192.168.2.4	1.1.1.1	0x4cf2	Standard query (0)	mail.mahesh-ent.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 2, 2024 13:15:54.485613108 CEST	1.1.1.1	192.168.2.4	0xa052	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Jul 2, 2024 13:15:54.485613108 CEST	1.1.1.1	192.168.2.4	0xa052	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Jul 2, 2024 13:15:54.485613108 CEST	1.1.1.1	192.168.2.4	0xa052	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Jul 2, 2024 13:15:56.573108912 CEST	1.1.1.1	192.168.2.4	0x8914	No error (0)	mail.mahesh-ent.com		148.66.136.151	A (IP address)	IN (0x0001)	false
Jul 2, 2024 13:16:33.146173954 CEST	1.1.1.1	192.168.2.4	0x5f9	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jul 2, 2024 13:17:47.448648930 CEST	1.1.1.1	192.168.2.4	0x4cf2	No error (0)	mail.mahesh-ent.com		148.66.136.151	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.74.152	443	6616	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 11:15:55 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-07-02 11:15:55 UTC	211	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 11:15:55 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89ce387fcccd7d0c-EWR
2024-07-02 11:15:55 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 2, 2024 13:15:57.952403069 CEST	587	49731	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Tue, 02 Jul 2024 04:15:57 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 2, 2024 13:15:57.952622890 CEST	49731	587	192.168.2.4	148.66.136.151	EHLO 760639
Jul 2, 2024 13:15:58.465684891 CEST	587	49731	148.66.136.151	192.168.2.4	250-sg2plzcpnl505494.prod.sin2.secureserver.net Hello 760639 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 2, 2024 13:15:58.503066063 CEST	49731	587	192.168.2.4	148.66.136.151	AUTH login aW5mb0BtYWhlc2gtZW50LmNvbQ==
Jul 2, 2024 13:15:58.853722095 CEST	587	49731	148.66.136.151	192.168.2.4	334 UGFzc3dvcmQ6
Jul 2, 2024 13:15:59.099636078 CEST	587	49731	148.66.136.151	192.168.2.4	334 UGFzc3dvcmQ6
Jul 2, 2024 13:15:59.462419987 CEST	587	49731	148.66.136.151	192.168.2.4	235 Authentication succeeded
Jul 2, 2024 13:15:59.463687897 CEST	49731	587	192.168.2.4	148.66.136.151	MAIL FROM:<info@mahesh-ent.com>
Jul 2, 2024 13:15:59.812216043 CEST	587	49731	148.66.136.151	192.168.2.4	250 OK
Jul 2, 2024 13:15:59.812500000 CEST	49731	587	192.168.2.4	148.66.136.151	RCPT TO:<obtxxxtf@gmail.com>
Jul 2, 2024 13:16:00.224934101 CEST	587	49731	148.66.136.151	192.168.2.4	250 Accepted
Jul 2, 2024 13:16:00.225099087 CEST	49731	587	192.168.2.4	148.66.136.151	DATA
Jul 2, 2024 13:16:00.573653936 CEST	587	49731	148.66.136.151	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jul 2, 2024 13:16:00.574297905 CEST	49731	587	192.168.2.4	148.66.136.151	.
Jul 2, 2024 13:16:08.508141994 CEST	587	49731	148.66.136.151	192.168.2.4	250 OK id=1sObUO-003Xax-1K
Jul 2, 2024 13:17:36.569644928 CEST	49731	587	192.168.2.4	148.66.136.151	QUIT
Jul 2, 2024 13:17:37.125201941 CEST	587	49731	148.66.136.151	192.168.2.4	221 sg2plzcpnl505494.prod.sin2.secureserver.net closing connection
Jul 2, 2024 13:17:48.305284023 CEST	587	58441	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Tue, 02 Jul 2024 04:17:48 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 2, 2024 13:17:48.305423975 CEST	58441	587	192.168.2.4	148.66.136.151	EHLO 760639
Jul 2, 2024 13:17:48.640779972 CEST	587	58441	148.66.136.151	192.168.2.4	250-sg2plzcpnl505494.prod.sin2.secureserver.net Hello 760639 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 2, 2024 13:17:48.640958071 CEST	58441	587	192.168.2.4	148.66.136.151	AUTH login aW5mb0BtYWhlc2gtZW50LmNvbQ==
Jul 2, 2024 13:17:48.976320982 CEST	587	58441	148.66.136.151	192.168.2.4	334 UGFzc3dvcmQ6
Jul 2, 2024 13:17:49.317924976 CEST	587	58441	148.66.136.151	192.168.2.4	235 Authentication succeeded
Jul 2, 2024 13:17:49.318754911 CEST	58441	587	192.168.2.4	148.66.136.151	MAIL FROM:<info@mahesh-ent.com>
Jul 2, 2024 13:17:49.653537035 CEST	587	58441	148.66.136.151	192.168.2.4	250 OK
Jul 2, 2024 13:17:49.653749943 CEST	58441	587	192.168.2.4	148.66.136.151	RCPT TO:<obtxxxtf@gmail.com>
Jul 2, 2024 13:17:50.026819944 CEST	587	58441	148.66.136.151	192.168.2.4	250 Accepted
Jul 2, 2024 13:17:50.026962042 CEST	58441	587	192.168.2.4	148.66.136.151	DATA
Jul 2, 2024 13:17:50.362313032 CEST	587	58441	148.66.136.151	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jul 2, 2024 13:17:52.429682016 CEST	587	58442	148.66.136.151	192.168.2.4	421 Too many concurrent SMTP connections from this IP address; please try again later.
Jul 2, 2024 13:18:06.133253098 CEST	587	58443	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Tue, 02 Jul 2024 04:18:05 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 2, 2024 13:18:06.133519888 CEST	58443	587	192.168.2.4	148.66.136.151	EHLO 760639
Jul 2, 2024 13:18:06.483870983 CEST	587	58443	148.66.136.151	192.168.2.4	250-sg2plzcpnl505494.prod.sin2.secureserver.net Hello 760639 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 2, 2024 13:18:06.484155893 CEST	58443	587	192.168.2.4	148.66.136.151	AUTH login aW5mb0BtYWhlc2gtZW50LmNvbQ==
Jul 2, 2024 13:18:06.890506029 CEST	587	58443	148.66.136.151	192.168.2.4	334 UGFzc3dvcmQ6
Jul 2, 2024 13:18:07.258297920 CEST	587	58443	148.66.136.151	192.168.2.4	235 Authentication succeeded
Jul 2, 2024 13:18:07.259251118 CEST	58443	587	192.168.2.4	148.66.136.151	MAIL FROM:<info@mahesh-ent.com>
Jul 2, 2024 13:18:07.613781929 CEST	587	58443	148.66.136.151	192.168.2.4	250 OK
Jul 2, 2024 13:18:07.621807098 CEST	58443	587	192.168.2.4	148.66.136.151	RCPT TO:<obtxxxtf@gmail.com>
Jul 2, 2024 13:18:08.023377895 CEST	587	58443	148.66.136.151	192.168.2.4	250 Accepted
Jul 2, 2024 13:18:08.023529053 CEST	58443	587	192.168.2.4	148.66.136.151	DATA
Jul 2, 2024 13:18:08.373920918 CEST	587	58443	148.66.136.151	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jul 2, 2024 13:18:08.400418043 CEST	58443	587	192.168.2.4	148.66.136.151	.
Jul 2, 2024 13:18:13.722073078 CEST	587	58444	148.66.136.151	192.168.2.4	421 Too many concurrent SMTP connections from this IP address; please try again later.
Jul 2, 2024 13:18:15.044183016 CEST	587	58445	148.66.136.151	192.168.2.4	421 Too many concurrent SMTP connections from this IP address; please try again later.
Jul 2, 2024 13:18:20.221935034 CEST	587	58446	148.66.136.151	192.168.2.4	421 Too many concurrent SMTP connections from this IP address; please try again later.
Jul 2, 2024 13:18:36.462376118 CEST	587	58447	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Tue, 02 Jul 2024 04:18:36 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 2, 2024 13:18:36.462769032 CEST	58447	587	192.168.2.4	148.66.136.151	EHLO 760639
Jul 2, 2024 13:18:36.463644028 CEST	587	58447	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Tue, 02 Jul 2024 04:18:36 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 2, 2024 13:18:36.806294918 CEST	587	58447	148.66.136.151	192.168.2.4	250-sg2plzcpnl505494.prod.sin2.secureserver.net Hello 760639 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 2, 2024 13:18:36.806457996 CEST	58447	587	192.168.2.4	148.66.136.151	AUTH login aW5mb0BtYWhlc2gtZW50LmNvbQ==
Jul 2, 2024 13:18:37.421561003 CEST	587	58447	148.66.136.151	192.168.2.4	334 UGFzc3dvcmQ6
Jul 2, 2024 13:18:37.421957970 CEST	587	58447	148.66.136.151	192.168.2.4	334 UGFzc3dvcmQ6
Jul 2, 2024 13:18:37.774101019 CEST	587	58447	148.66.136.151	192.168.2.4	235 Authentication succeeded
Jul 2, 2024 13:18:37.780750990 CEST	58447	587	192.168.2.4	148.66.136.151	MAIL FROM:<info@mahesh-ent.com>
Jul 2, 2024 13:18:38.126039028 CEST	587	58447	148.66.136.151	192.168.2.4	250 OK
Jul 2, 2024 13:18:38.126233101 CEST	58447	587	192.168.2.4	148.66.136.151	RCPT TO:<obtxxxtf@gmail.com>
Jul 2, 2024 13:18:38.505870104 CEST	587	58447	148.66.136.151	192.168.2.4	250 Accepted
Jul 2, 2024 13:18:38.506037951 CEST	58447	587	192.168.2.4	148.66.136.151	DATA
Jul 2, 2024 13:18:38.859666109 CEST	587	58447	148.66.136.151	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jul 2, 2024 13:18:54.007971048 CEST	587	58448	148.66.136.151	192.168.2.4	421 Too many concurrent SMTP connections from this IP address; please try again later.
Jul 2, 2024 13:18:58.731825113 CEST	587	58449	148.66.136.151	192.168.2.4	421 Too many concurrent SMTP connections from this IP address; please try again later.
Jul 2, 2024 13:19:17.236152887 CEST	587	58450	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Tue, 02 Jul 2024 04:19:17 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 2, 2024 13:19:17.236346006 CEST	58450	587	192.168.2.4	148.66.136.151	EHLO 760639
Jul 2, 2024 13:19:17.571408033 CEST	587	58450	148.66.136.151	192.168.2.4	250-sg2plzcpnl505494.prod.sin2.secureserver.net Hello 760639 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 2, 2024 13:19:17.571569920 CEST	58450	587	192.168.2.4	148.66.136.151	AUTH login aW5mb0BtYWhlc2gtZW50LmNvbQ==
Jul 2, 2024 13:19:18.598768950 CEST	587	58451	148.66.136.151	192.168.2.4	421 Too many concurrent SMTP connections from this IP address; please try again later.
Jul 2, 2024 13:19:26.467442036 CEST	587	58452	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Tue, 02 Jul 2024 04:19:26 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 2, 2024 13:19:26.467721939 CEST	58452	587	192.168.2.4	148.66.136.151	EHLO 760639
Jul 2, 2024 13:19:26.883757114 CEST	587	58452	148.66.136.151	192.168.2.4	250-sg2plzcpnl505494.prod.sin2.secureserver.net Hello 760639 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 2, 2024 13:19:26.888397932 CEST	58452	587	192.168.2.4	148.66.136.151	AUTH login aW5mb0BtYWhlc2gtZW50LmNvbQ==
Jul 2, 2024 13:19:31.224323988 CEST	587	58452	148.66.136.151	192.168.2.4	334 UGFzc3dvcmQ6
Jul 2, 2024 13:19:31.572490931 CEST	587	58452	148.66.136.151	192.168.2.4	235 Authentication succeeded
Jul 2, 2024 13:19:31.572632074 CEST	58452	587	192.168.2.4	148.66.136.151	MAIL FROM:<info@mahesh-ent.com>
Jul 2, 2024 13:19:32.038327932 CEST	587	58452	148.66.136.151	192.168.2.4	250 OK
Jul 2, 2024 13:19:32.038481951 CEST	58452	587	192.168.2.4	148.66.136.151	RCPT TO:<obtxxxtf@gmail.com>
Jul 2, 2024 13:19:32.411041975 CEST	587	58452	148.66.136.151	192.168.2.4	250 Accepted
Jul 2, 2024 13:19:32.411209106 CEST	58452	587	192.168.2.4	148.66.136.151	DATA
Jul 2, 2024 13:19:32.752470970 CEST	587	58452	148.66.136.151	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jul 2, 2024 13:19:41.822902918 CEST	587	58453	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Tue, 02 Jul 2024 04:19:41 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 2, 2024 13:19:41.823021889 CEST	58453	587	192.168.2.4	148.66.136.151	EHLO 760639
Jul 2, 2024 13:19:42.162431002 CEST	587	58453	148.66.136.151	192.168.2.4	250-sg2plzcpnl505494.prod.sin2.secureserver.net Hello 760639 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 2, 2024 13:19:42.162698984 CEST	58453	587	192.168.2.4	148.66.136.151	AUTH login aW5mb0BtYWhlc2gtZW50LmNvbQ==
Jul 2, 2024 13:19:42.502815962 CEST	587	58453	148.66.136.151	192.168.2.4	334 UGFzc3dvcmQ6
Jul 2, 2024 13:19:42.856380939 CEST	587	58453	148.66.136.151	192.168.2.4	235 Authentication succeeded
Jul 2, 2024 13:19:42.858834028 CEST	58453	587	192.168.2.4	148.66.136.151	MAIL FROM:<info@mahesh-ent.com>
Jul 2, 2024 13:19:43.197216034 CEST	587	58453	148.66.136.151	192.168.2.4	250 OK
Jul 2, 2024 13:19:43.197397947 CEST	58453	587	192.168.2.4	148.66.136.151	RCPT TO:<obtxxxtf@gmail.com>
Jul 2, 2024 13:19:43.575424910 CEST	587	58453	148.66.136.151	192.168.2.4	250 Accepted
Jul 2, 2024 13:19:43.575603962 CEST	58453	587	192.168.2.4	148.66.136.151	DATA
Jul 2, 2024 13:19:43.915930033 CEST	587	58453	148.66.136.151	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jul 2, 2024 13:19:52.599196911 CEST	587	58453	148.66.136.151	192.168.2.4	250 OK id=1sObXz-003Zpa-2Q
Jul 2, 2024 13:20:01.010708094 CEST	58453	587	192.168.2.4	148.66.136.151	QUIT
Jul 2, 2024 13:20:01.555083036 CEST	587	58453	148.66.136.151	192.168.2.4	221 sg2plzcpnl505494.prod.sin2.secureserver.net closing connection
Jul 2, 2024 13:20:02.451948881 CEST	587	58454	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Tue, 02 Jul 2024 04:20:02 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.

Target ID:	0
Start time:	07:15:52
Start date:	02/07/2024
Path:	C:\Users\user\Desktop\arrival notice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\arrival notice.exe"
Imagebase:	0x9d0000
File size:	1'267'712 bytes
MD5 hash:	3ED45724AE4635F06EB3BE7CA4FE97AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1649097610.0000000000B10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1649097610.0000000000B10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.1649097610.0000000000B10000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:15:52
Start date:	02/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\arrival notice.exe"
Imagebase:	0xb80000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4110380759.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4110380759.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4111551921.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4111551921.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	1.3%
Signature Coverage:	2.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	54

Executed Functions

Function 009D3B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 009D3B7A
IsDebuggerPresent.KERNEL32 ref: 009D3B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,00A962F8,00A962E0,?,?), ref: 009D3BFD

Part of subcall function 009D7D2C: _memmove.LIBCMT ref: 009D7D66

Part of subcall function 009E0A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,009D3C26,00A962F8,?,?,?), ref: 009E0ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 009D3C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00A893F0,00000010), ref: 00A0D4BC
SetCurrentDirectoryW.KERNEL32(?,00A962F8,?,?,?), ref: 00A0D4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00A85D40,00A962F8,?,?,?), ref: 00A0D57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 00A0D581

Part of subcall function 009D3A58: GetSysColorBrush.USER32(0000000F), ref: 009D3A62
Part of subcall function 009D3A58: LoadCursorW.USER32(00000000,00007F00), ref: 009D3A71
Part of subcall function 009D3A58: LoadIconW.USER32(00000063), ref: 009D3A88
Part of subcall function 009D3A58: LoadIconW.USER32(000000A4), ref: 009D3A9A
Part of subcall function 009D3A58: LoadIconW.USER32(000000A2), ref: 009D3AAC
Part of subcall function 009D3A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 009D3AD2
Part of subcall function 009D3A58: RegisterClassExW.USER32(?), ref: 009D3B28

Part of subcall function 009D39E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 009D3A15
Part of subcall function 009D39E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 009D3A36
Part of subcall function 009D39E7: ShowWindow.USER32(00000000,?,?), ref: 009D3A4A
Part of subcall function 009D39E7: ShowWindow.USER32(00000000,?,?), ref: 009D3A53

Part of subcall function 009D43DB: _memset.LIBCMT ref: 009D4401
Part of subcall function 009D43DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 009D44A6

Strings

This is a third-party compiled AutoIt script., xrefs: 00A0D4B4
runas, xrefs: 00A0D575

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 822276df1e6276f635ffae4ccc6ec3fed9d7df8221120a79c3a03e0d9ad803df
Instruction ID: f56deed95fb25c34bdb701df2ecff74c7bd19f4ec11ddf8d06e09dd3ff71678e
Opcode Fuzzy Hash: 822276df1e6276f635ffae4ccc6ec3fed9d7df8221120a79c3a03e0d9ad803df
Instruction Fuzzy Hash: 2B51F571E54248BECF11EBF4EC05AFEBB78BF84341B04C167F851A62A1DA745A46CB21

Function 009D4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 009D4B2B

Part of subcall function 009D7D2C: _memmove.LIBCMT ref: 009D7D66

GetCurrentProcess.KERNEL32(?,00A5FAEC,00000000,00000000,?), ref: 009D4BF8
IsWow64Process.KERNEL32(00000000), ref: 009D4BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 009D4C45
FreeLibrary.KERNEL32(00000000), ref: 009D4C50
GetSystemInfo.KERNEL32(00000000), ref: 009D4C81
GetSystemInfo.KERNEL32(00000000), ref: 009D4C8D

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 6b31e3d8f042d30c97b060058972a494caa5cdb64337a9812687f71d2c8a808c
Instruction ID: 789c2f57ba5c8338e0ac26c5b05f1ee6cdf6d1223e27b74298f0503800192768
Opcode Fuzzy Hash: 6b31e3d8f042d30c97b060058972a494caa5cdb64337a9812687f71d2c8a808c
Instruction Fuzzy Hash: B691A03198ABC4DFC721DBB895511AABFE4AF36300B488E5FD0CA97B41D235A908C759

Function 009D4FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,009D4EEE,?,?,00000000,00000000), ref: 009D4FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,009D4EEE,?,?,00000000,00000000), ref: 009D5010
LoadResource.KERNEL32(?,00000000,?,?,009D4EEE,?,?,00000000,00000000,?,?,?,?,?,?,009D4F8F), ref: 00A0DD60
SizeofResource.KERNEL32(?,00000000,?,?,009D4EEE,?,?,00000000,00000000,?,?,?,?,?,?,009D4F8F), ref: 00A0DD75
LockResource.KERNEL32(009D4EEE,?,?,009D4EEE,?,?,00000000,00000000,?,?,?,?,?,?,009D4F8F,00000000), ref: 00A0DD88

Strings

SCRIPT, xrefs: 009D5006

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: e964c1a212c450fc54bc16f3d51769bc05bfdad56bfd4475601a7e4b7b1ae032
Instruction ID: c707e48c7a9dd73d8f060e62b34f8ce54069fefdb40d33c1f5232d0e35995e67
Opcode Fuzzy Hash: e964c1a212c450fc54bc16f3d51769bc05bfdad56bfd4475601a7e4b7b1ae032
Instruction Fuzzy Hash: A7115EB5240700BFD7218B65EC58F677BBDFBC9B52F208569F409862A0DB71E801C661

Function 00A34696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00A0E7C1), ref: 00A346A6
FindFirstFileW.KERNELBASE(?,?), ref: 00A346B7
FindClose.KERNEL32(00000000), ref: 00A346C7

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 99ee049c97abaa7202f328cd65574b8f3301cf3858f9da56b9ffeefb9907c4b7
Instruction ID: cbae238387ea2f3f88c11249ab11c931d1185f50570c847d6953e9bf19639e27
Opcode Fuzzy Hash: 99ee049c97abaa7202f328cd65574b8f3301cf3858f9da56b9ffeefb9907c4b7
Instruction Fuzzy Hash: 52E0D831414A005F5210AB78EC4E4EE775CAE0B336F100715F935C20F0F7B06D508596

Function 009DE800 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00A1428C

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: c87615186755755e9bd4d34ec90e21e674eb3143e84db3d751ea07a37b835a58
Instruction ID: 2622e628c368011ded442556c9ea8e5923a66b3adcfa8fa19f9c940de56cb1ef
Opcode Fuzzy Hash: c87615186755755e9bd4d34ec90e21e674eb3143e84db3d751ea07a37b835a58
Instruction Fuzzy Hash: D5A29974A44215CFCB24DF98C590AAEB7B6FF58300F24C46AE916AF351D734AD82CB91

Function 009E0B30 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009E0BBB
timeGetTime.WINMM ref: 009E0E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009E0FB3
TranslateMessage.USER32(?), ref: 009E0FC7
DispatchMessageW.USER32(?), ref: 009E0FD5
Sleep.KERNEL32(0000000A), ref: 009E0FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 009E105A
DestroyWindow.USER32 ref: 009E1066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 009E1080
Sleep.KERNEL32(0000000A,?,?), ref: 00A152AD
TranslateMessage.USER32(?), ref: 00A1608A
DispatchMessageW.USER32(?), ref: 00A16098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00A160AC

Strings

@COM_EVENTOBJ, xrefs: 00A1591A
@GUI_WINHANDLE, xrefs: 00A153B9
@GUI_CTRLHANDLE, xrefs: 00A1540E
@GUI_CTRLID, xrefs: 00A15364
@TRAY_ID, xrefs: 00A15BB9

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4003667617-3242690629
Opcode ID: 173a834b6f644043a3778f9f8838ebbe50db345067ec96d0c885acca12340add
Instruction ID: 81038c16a2bfbe5cb72cd2be40f6a6f12f69722514faece89da1a5e6d99a83cc
Opcode Fuzzy Hash: 173a834b6f644043a3778f9f8838ebbe50db345067ec96d0c885acca12340add
Instruction Fuzzy Hash: 1BB2B170A08781DFD725DF24C884BAAB7E5BFC4304F14891EE49A87291DB75EC85CB92

Function 00A393DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A391E9: __time64.LIBCMT ref: 00A391F3

Part of subcall function 009D5045: _fseek.LIBCMT ref: 009D505D

__wsplitpath.LIBCMT ref: 00A394BE

Part of subcall function 009F432E: __wsplitpath_helper.LIBCMT ref: 009F436E

_wcscpy.LIBCMT ref: 00A394D1
_wcscat.LIBCMT ref: 00A394E4
__wsplitpath.LIBCMT ref: 00A39509
_wcscat.LIBCMT ref: 00A3951F
_wcscat.LIBCMT ref: 00A39532

Part of subcall function 00A3922F: _memmove.LIBCMT ref: 00A39268
Part of subcall function 00A3922F: _memmove.LIBCMT ref: 00A39277

_wcscmp.LIBCMT ref: 00A39479

Part of subcall function 00A399BE: _wcscmp.LIBCMT ref: 00A39AAE
Part of subcall function 00A399BE: _wcscmp.LIBCMT ref: 00A39AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00A396DC
_wcsncpy.LIBCMT ref: 00A3974F
DeleteFileW.KERNEL32(?,?), ref: 00A39785
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00A3979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A397AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A397BE

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 062dcf04c971ae5382fb24dd113155cdd1e2de0bdd04a3db45c545f4199d4de6
Instruction ID: 92fdc3946f7d2fc92c0ca718974ac8ccd2584a39bd9ac42ece28d0aae4f249a1
Opcode Fuzzy Hash: 062dcf04c971ae5382fb24dd113155cdd1e2de0bdd04a3db45c545f4199d4de6
Instruction Fuzzy Hash: 93C12BB1D00219AFDF21DF94CD85AEFB7BDAF95340F0040AAF609E6251DB709A848F65

Function 009D3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 69
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 009D3074
RegisterClassExW.USER32(00000030), ref: 009D309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009D30AF
InitCommonControlsEx.COMCTL32(?), ref: 009D30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009D30DC
LoadIconW.USER32(000000A9), ref: 009D30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009D3101

Strings

+, xrefs: 009D305D
TaskbarCreated, xrefs: 009D30A4
AutoIt v3 GUI, xrefs: 009D3090
0, xrefs: 009D3056

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 85831f1415aac6685a51d53c8be923d9b7ba96ca24dec200d01768861798eb57
Instruction ID: 2b2e1b467a94263ac291902b2ff5d21a655a176fac00e4b9b752c79e2742641d
Opcode Fuzzy Hash: 85831f1415aac6685a51d53c8be923d9b7ba96ca24dec200d01768861798eb57
Instruction Fuzzy Hash: E83103B1941349AFDB10CFE4E889AD9BBF0FF09311F14856AE990A62A0E7B50586CF51

Function 009D3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 009D3074
RegisterClassExW.USER32(00000030), ref: 009D309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009D30AF
InitCommonControlsEx.COMCTL32(?), ref: 009D30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009D30DC
LoadIconW.USER32(000000A9), ref: 009D30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009D3101

Strings

+, xrefs: 009D305D
TaskbarCreated, xrefs: 009D30A4
AutoIt v3 GUI, xrefs: 009D3090
0, xrefs: 009D3056

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 7bffd95a5948184f09ee811c2bf8f0ec4fd5f60d68fd14c6af0648599cd4c76a
Instruction ID: 0dfdf6c26e7b13462ed2c20d8537c51491ecdbb0099808130eef67929c96b2da
Opcode Fuzzy Hash: 7bffd95a5948184f09ee811c2bf8f0ec4fd5f60d68fd14c6af0648599cd4c76a
Instruction Fuzzy Hash: 3121C5B5E51318AFDB00DFE4E849BDDBBF4FB08711F00812AF910A62A0DBB145468F91

Function 009D71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009D4864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00A962F8,?,009D37C0,?), ref: 009D4882

Part of subcall function 009F074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,009D72C5), ref: 009F0771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 009D7308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00A0ECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00A0ED32
RegCloseKey.ADVAPI32(?), ref: 00A0ED70
_wcscat.LIBCMT ref: 00A0EDC9

Strings

\, xrefs: 00A0EDEC
\Include\, xrefs: 009D72C5
Software\AutoIt v3\AutoIt, xrefs: 009D72FE
Include, xrefs: 00A0ECE8, 00A0ED29

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: e0cd1bfe86e3586f96742c0b98fe153b80439ba811aad2f4122fa33694139753
Instruction ID: c7aa4b55e014997119b28bf0954fe52672409d41b491061cd26bada64a95073c
Opcode Fuzzy Hash: e0cd1bfe86e3586f96742c0b98fe153b80439ba811aad2f4122fa33694139753
Instruction Fuzzy Hash: AC7170716683059EC714EFA5EC81AAFBBE8FF94340F44492FF545832A0EB309949CB61

Function 009D3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 009D3A62
LoadCursorW.USER32(00000000,00007F00), ref: 009D3A71
LoadIconW.USER32(00000063), ref: 009D3A88
LoadIconW.USER32(000000A4), ref: 009D3A9A
LoadIconW.USER32(000000A2), ref: 009D3AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 009D3AD2
RegisterClassExW.USER32(?), ref: 009D3B28

Part of subcall function 009D3041: GetSysColorBrush.USER32(0000000F), ref: 009D3074
Part of subcall function 009D3041: RegisterClassExW.USER32(00000030), ref: 009D309E
Part of subcall function 009D3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009D30AF
Part of subcall function 009D3041: InitCommonControlsEx.COMCTL32(?), ref: 009D30CC
Part of subcall function 009D3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009D30DC
Part of subcall function 009D3041: LoadIconW.USER32(000000A9), ref: 009D30F2
Part of subcall function 009D3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009D3101

Strings

AutoIt v3, xrefs: 009D3B17
0, xrefs: 009D3B06
#, xrefs: 009D3B0D

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 4f082e5011c85c3792f14f30b63f865b9989e1f5eff322289a0aeaa554dc29ee
Instruction ID: d7b4ee9524db3d20d2bb8cc19d29bed1cff2c1eedda3311406389daf28686284
Opcode Fuzzy Hash: 4f082e5011c85c3792f14f30b63f865b9989e1f5eff322289a0aeaa554dc29ee
Instruction Fuzzy Hash: 622117B1E40308AFEB10DFE4EC49BDD7BB4FB08711F00416AF504A62A0DBBA56569F94

Function 009D3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 009D36D2
KillTimer.USER32(?,00000001), ref: 009D36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 009D371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009D372A
CreatePopupMenu.USER32 ref: 009D373E
PostQuitMessage.USER32(00000000), ref: 009D375F

Strings

TaskbarCreated, xrefs: 009D3725

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 42d5bba9a51e65990e6147bd2a0c3205af6c21a8ebb229b0483fb74f1272b7a5
Instruction ID: 9a745bc2fd591ae404af6c3f533de8765c6066a036fef9771a2e5b1b490ba5ce
Opcode Fuzzy Hash: 42d5bba9a51e65990e6147bd2a0c3205af6c21a8ebb229b0483fb74f1272b7a5
Instruction Fuzzy Hash: A64116B2284605BBDF109BA4EC4ABBA3B98EF44342F04C52BF502963E1DA759D119663

Function 009D3778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3ExecuteScript, xrefs: 009D38CE
/AutoIt3ExecuteLine, xrefs: 009D38B9
CMDLINE, xrefs: 009D3834
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 009D37C0
/ErrorStdOut, xrefs: 009D388F
/AutoIt3OutputDebug, xrefs: 009D38A4
CMDLINERAW, xrefs: 009D380D

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 25480f240342f3b3709e3c4ff82cf4cb2a2b8c0b9de82a0e0f10717bdf5b1c0a
Instruction ID: b9b02b00db9e72735152165e3359d4ffe4087cd11da863360c87b84b9d6cf672
Opcode Fuzzy Hash: 25480f240342f3b3709e3c4ff82cf4cb2a2b8c0b9de82a0e0f10717bdf5b1c0a
Instruction Fuzzy Hash: 1CA14D72D5022DAACB04EBE4DC91BEEB778BF54340F44852AE412B7291EF745A09CB61

Function 009925D0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 009926A1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 009928C7

Memory Dump Source

Source File: 00000000.00000002.1648801357.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_arrival notice.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
Instruction ID: 4b0b9de5026f9cf05813fc7b2f1c2853ca37ccafaf3e7f847909cf248dd91009
Opcode Fuzzy Hash: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
Instruction Fuzzy Hash: 84A10774E04209EBDF14CFE8C994BEEB7B5BF48304F208559E511BB280D779AA81DB64

Function 009D39E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 009D3A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 009D3A36
ShowWindow.USER32(00000000,?,?), ref: 009D3A4A
ShowWindow.USER32(00000000,?,?), ref: 009D3A53

Strings

AutoIt v3, xrefs: 009D3A0D, 009D3A12, 009D3A13
edit, xrefs: 009D3A30

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: c718516c1e24fe1d69e6d1036b8a2832ca2db883146b4bd5f1a260133b381fc6
Instruction ID: fd04438315543be5b7a29d0b91ef15246903db20260cdaa6f8cab2a2284a120c
Opcode Fuzzy Hash: c718516c1e24fe1d69e6d1036b8a2832ca2db883146b4bd5f1a260133b381fc6
Instruction Fuzzy Hash: C4F0D071B412907EEA3197976C49EA72E7DEBC6F51B00412AB904A21B0CAB51852DAB0

Function 009923B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 142
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009922A0: Sleep.KERNELBASE(000001F4), ref: 009922B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 009924C8

Strings

87PEHZ7PPBWGA2PN, xrefs: 0099252B, 0099252E

Memory Dump Source

Source File: 00000000.00000002.1648801357.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_arrival notice.jbxd

Similarity

API ID: CreateFileSleep
String ID: 87PEHZ7PPBWGA2PN
API String ID: 2694422964-3100532331
Opcode ID: b2aafc5a8d4a2b3d15a482cc431bda9b7e1c1cdacc955934e0786f5efec50e29
Instruction ID: d8748d81cf893e1a7543208bf2d061c69e59931ee87649f53bf660a60f2a4872
Opcode Fuzzy Hash: b2aafc5a8d4a2b3d15a482cc431bda9b7e1c1cdacc955934e0786f5efec50e29
Instruction Fuzzy Hash: 74518330D04249EBEF11DBA8C815BEEBB79AF54300F004598F218BB2C0D7B91B45CBA6

Function 009D410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00A0D5EC

Part of subcall function 009D7D2C: _memmove.LIBCMT ref: 009D7D66

_memset.LIBCMT ref: 009D418D
_wcscpy.LIBCMT ref: 009D41E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 009D41F1

Strings

Line: , xrefs: 00A0D615

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: d244c8bfb00a4629d19266cfe31efbc6beda75829476f8631459040b89a0cb6f
Instruction ID: 5b5e25a71862b843ea0de958e1608aeb448dc37fb645c5576ef1782076ca8a88
Opcode Fuzzy Hash: d244c8bfb00a4629d19266cfe31efbc6beda75829476f8631459040b89a0cb6f
Instruction Fuzzy Hash: 8B31D171548304AFD721EBA0DC46BDBB7ECAF94300F108A1FF185922A1EF74A649C792

Function 009F564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 009F56AB
_memcpy_s.LIBCMT ref: 009F571D
__read_nolock.LIBCMT ref: 009F577B
__filbuf.LIBCMT ref: 009F579E
_memset.LIBCMT ref: 009F57E2

Part of subcall function 009F8D68: __getptd_noexit.LIBCMT ref: 009F8D68

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: 395178bb337f8d19fc1ff645be81e8c296cd9444000c5c283bc26de8abe42a2d
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: 3051B270A00B0DDBDB24AFB9C88467E77A9AF40324F668729FB35D62D0DB749D518B40

Function 009D69CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 009D4F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00A962F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 009D4F6F

_free.LIBCMT ref: 00A0E68C
_free.LIBCMT ref: 00A0E6D3

Part of subcall function 009D6BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 009D6D0D

Strings

Bad directive syntax error, xrefs: 00A0E6BB
>>>AUTOIT SCRIPT<<<, xrefs: 00A0E462

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 85e3d510ec631bb1d8ce01c066c18f67de60c64d23f3811fbcdfcf3509627011
Instruction ID: 22dfb60d65fa4b358a497cd6bdc3d58f3053557731091fe6d7fbf83298b2e56a
Opcode Fuzzy Hash: 85e3d510ec631bb1d8ce01c066c18f67de60c64d23f3811fbcdfcf3509627011
Instruction Fuzzy Hash: D9916D71910219EFCF04EFA8DC91AEDB7B4BF55314F14886AF815AB2A1EB31A904DB50

Function 009D35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,009D35A1,SwapMouseButtons,00000004,?), ref: 009D35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,009D35A1,SwapMouseButtons,00000004,?,?,?,?,009D2754), ref: 009D35F5
RegCloseKey.KERNELBASE(00000000,?,?,009D35A1,SwapMouseButtons,00000004,?,?,?,?,009D2754), ref: 009D3617

Strings

Control Panel\Mouse, xrefs: 009D35D2

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 24eebfc621676ec6933b7c3b3fb0da53897f9763a2fb16c16d56bc5c7a26d1d9
Instruction ID: cf0bd6fafda3d1fe0d3d4b1ba25fca6ccac1157b17d0140a4be02255c7c6c0ea
Opcode Fuzzy Hash: 24eebfc621676ec6933b7c3b3fb0da53897f9763a2fb16c16d56bc5c7a26d1d9
Instruction Fuzzy Hash: BA113375650208BEDB20CFA5DC81EAEBBACEF04742F40846AA805D7210E2719E419BA1

Function 009912A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00991ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00991AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00991B13

Memory Dump Source

Source File: 00000000.00000002.1648801357.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_arrival notice.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
Instruction ID: 2ee63aea4efb780da8b6a503103bb5cbd8500448b5894b418f3a29d047f34016
Opcode Fuzzy Hash: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
Instruction Fuzzy Hash: 56620930A14259DBEB24CFA4C841BDEB376FF58300F1095A9D10DEB294E77A9E81CB59

Function 00A397E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 009D5045: _fseek.LIBCMT ref: 009D505D

Part of subcall function 00A399BE: _wcscmp.LIBCMT ref: 00A39AAE
Part of subcall function 00A399BE: _wcscmp.LIBCMT ref: 00A39AC1

_free.LIBCMT ref: 00A3992C
_free.LIBCMT ref: 00A39933
_free.LIBCMT ref: 00A3999E

Part of subcall function 009F2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,009F9C64), ref: 009F2FA9
Part of subcall function 009F2F95: GetLastError.KERNEL32(00000000,?,009F9C64), ref: 009F2FBB

_free.LIBCMT ref: 00A399A6

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction ID: 24324fc07a88e58a8000ad5c95aa6ceeb33cfa4852865bbc0844b7ad5f57298c
Opcode Fuzzy Hash: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction Fuzzy Hash: 855140B1904218AFDF249F64DC41BAEBB79EF88310F1044AEB609A7351DB755E80CF59

Function 009F493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009F49D0
__flush.LIBCMT ref: 009F49F0
__write.LIBCMT ref: 009F4A23
__flsbuf.LIBCMT ref: 009F4A51

Part of subcall function 009F8D68: __getptd_noexit.LIBCMT ref: 009F8D68

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: 9631ebe2bee7337dab5de1474e539dddcea2e004ad0707383061d119af89daa9
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: 3F41D87074070E9BDF18CE69C8809BF77AAEF80760B24853DEA55C7650D770DD908B44

Function 009D73E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A0EE62
GetOpenFileNameW.COMDLG32(?), ref: 00A0EEAC

Part of subcall function 009D48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009D48A1,?,?,009D37C0,?), ref: 009D48CE

Part of subcall function 009F09D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 009F09F4

Strings

X, xrefs: 00A0EE7A

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: b2b401dadbc928bcce653aaa3ca996c68a872f5b7c8e5d41cb96f1acbf2ae5ff
Instruction ID: 79a8ffc60e47ca25aacd8e6de2a2d07f9f217ab0a3733c7a70e517a936642273
Opcode Fuzzy Hash: b2b401dadbc928bcce653aaa3ca996c68a872f5b7c8e5d41cb96f1acbf2ae5ff
Instruction Fuzzy Hash: 9721C670A0025C9BCB05DFD4C8457EEBBFD9F49300F04801AE508E7381EBB859898BA1

Function 00A3901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A39036
__fread_nolock.LIBCMT ref: 00A3904B

Strings

EA06, xrefs: 00A3907D

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 1d0a486fdec6e63db4fd63c6d4e8d6caa752934bf3c9cea078813cd9fa6bf77f
Instruction ID: 9b1085ff6ded4f587de4373b3a80aa20e59198085a08bec64259960376f64423
Opcode Fuzzy Hash: 1d0a486fdec6e63db4fd63c6d4e8d6caa752934bf3c9cea078813cd9fa6bf77f
Instruction Fuzzy Hash: 0C01F971804218BEDB28C7A8C816FFE7BF89B11311F00419BF652D2181E5B5A6148BA0

Function 00A39B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00A39B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00A39B99

Strings

aut, xrefs: 00A39B93

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: f731fd8bab72cd4c982cd4391586cbe6f7b422ef0824871b412015788c8a5283
Instruction ID: ed338363cd1d15534ce45ec4d823b488de4fdfe27c9b2c90872dccaa2061abf9
Opcode Fuzzy Hash: f731fd8bab72cd4c982cd4391586cbe6f7b422ef0824871b412015788c8a5283
Instruction Fuzzy Hash: 5AD05EB954030DBFDB10EBD0DC0EFDA772CF714701F0046A1BE54960A1DEB055998B92

Function 00A4CDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 545c9c186842800c6f1a7e664f40961d990997ca1fa1f20e1bde77736efd6d5c
Instruction ID: 7aabe677b67d0f1e6041f6ece9ce96f9fbf05a2718c0ddf79adf66f5c3b65f51
Opcode Fuzzy Hash: 545c9c186842800c6f1a7e664f40961d990997ca1fa1f20e1bde77736efd6d5c
Instruction Fuzzy Hash: 42F11575A083019FCB14DF28C584A6ABBE5BFC8314F14892EF89A9B351D771E945CF82

Function 009DF8CF Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 009F03A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 009F03D3
Part of subcall function 009F03A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 009F03DB
Part of subcall function 009F03A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 009F03E6
Part of subcall function 009F03A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 009F03F1
Part of subcall function 009F03A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 009F03F9
Part of subcall function 009F03A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 009F0401

Part of subcall function 009E6259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,009DFA90), ref: 009E62B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 009DFB2D
OleInitialize.OLE32(00000000), ref: 009DFBAA
CloseHandle.KERNEL32(00000000), ref: 00A149F2

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 9ab9eb12c7518ac849f4e89ebd1c072a2bf1b98ec10db36d56c3a537689996f8
Instruction ID: 7f833eeab1a74679751abd50f7d1c676df61afb55b50182b558db16fd4aa6d65
Opcode Fuzzy Hash: 9ab9eb12c7518ac849f4e89ebd1c072a2bf1b98ec10db36d56c3a537689996f8
Instruction Fuzzy Hash: F88196B4B452508FCB84EFFAAA9165A7BE4FF98748710852B9019CB362EF358406CF51

Function 009D43DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009D4401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 009D44A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 009D44C3

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 7d110c3a9d742089973a1e20b0fcd52d9bffe84b9a50ca3f487353f69cde28a6
Instruction ID: f5efa14e873d90a99593663166e494b6379608bbf5b7f4983e72179c16c8b47d
Opcode Fuzzy Hash: 7d110c3a9d742089973a1e20b0fcd52d9bffe84b9a50ca3f487353f69cde28a6
Instruction Fuzzy Hash: EC315EB1A087018FD720DF64D88479BBBF8BB48304F00492FF59A87391DB75A984CB92

Function 009F594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 009F5963

Part of subcall function 009FA3AB: __NMSG_WRITE.LIBCMT ref: 009FA3D2
Part of subcall function 009FA3AB: __NMSG_WRITE.LIBCMT ref: 009FA3DC

__NMSG_WRITE.LIBCMT ref: 009F596A

Part of subcall function 009FA408: GetModuleFileNameW.KERNEL32(00000000,00A943BA,00000104,?,00000001,00000000), ref: 009FA49A
Part of subcall function 009FA408: ___crtMessageBoxW.LIBCMT ref: 009FA548

Part of subcall function 009F32DF: ___crtCorExitProcess.LIBCMT ref: 009F32E5
Part of subcall function 009F32DF: ExitProcess.KERNEL32 ref: 009F32EE

Part of subcall function 009F8D68: __getptd_noexit.LIBCMT ref: 009F8D68

RtlAllocateHeap.NTDLL(01380000,00000000,00000001,00000000,?,?,?,009F1013,?), ref: 009F598F

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: a657b0a6054a87c99ded84073b20453901b58ab3ca227d999c7b3b6282c01f14
Instruction ID: c9242fa4f93275e892cd4dcb84a7f1f4824e8f5f38b0cb60f7c549d4917008ec
Opcode Fuzzy Hash: a657b0a6054a87c99ded84073b20453901b58ab3ca227d999c7b3b6282c01f14
Instruction Fuzzy Hash: 8401D271300B1EEEE6296B64D842B7E738C9F81731F92002AF7049A1C1DEB49D828360

Function 00A39B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00A397D2,?,?,?,?,?,00000004), ref: 00A39B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00A397D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00A39B5B
CloseHandle.KERNEL32(00000000,?,00A397D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00A39B62

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: ad0c852a5e07c37477f9cb4e5ba9ee97eb30ab303992729c3f9b147eb04062f2
Instruction ID: 273a600af3d3c03f2a924ebfdcc783463e011df93a224fa4d7536447676fc4e9
Opcode Fuzzy Hash: ad0c852a5e07c37477f9cb4e5ba9ee97eb30ab303992729c3f9b147eb04062f2
Instruction Fuzzy Hash: FBE08632181714BBE7216F94EC09FCA7B18BB05772F104220FB24A90E087B125129798

Function 00A38F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A38FA5

Part of subcall function 009F2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,009F9C64), ref: 009F2FA9
Part of subcall function 009F2F95: GetLastError.KERNEL32(00000000,?,009F9C64), ref: 009F2FBB

_free.LIBCMT ref: 00A38FB6
_free.LIBCMT ref: 00A38FC8

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction ID: f09ea0917bb025ae3f8d8b3cc83bf2e7f9c5864b9a3073f39827eb61a8c282b5
Opcode Fuzzy Hash: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction Fuzzy Hash: 65E017A161D7054BCA24A778AD40BA367FE5F88360B18081EBA09DB182DE28E8418628

Function 009DAB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00A1002B

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 77a486cd6394156522e69d56a0bf087d248fca45a9ea0e376c5b30df4d7e6869
Instruction ID: d9e789169bd6d6d1b80d7869c58b3bb5040f6eaffbd3edc4f1e9f2cea597f5fc
Opcode Fuzzy Hash: 77a486cd6394156522e69d56a0bf087d248fca45a9ea0e376c5b30df4d7e6869
Instruction Fuzzy Hash: 74224874548251DFCB24DF14C590B6ABBE5BF84300F19C95EE88A8B362D775ED81CB82

Function 009D4DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009D4E1A

Strings

EA06, xrefs: 00A0DCF5

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 57408072d572925b95167c7a9109cfeeceeee8064b1e8c24f93cc7addef39253
Instruction ID: 30ce1aef44f81d374cb64a03fcf6ba6ccf0bb04b9156ef6144d5795280308b0e
Opcode Fuzzy Hash: 57408072d572925b95167c7a9109cfeeceeee8064b1e8c24f93cc7addef39253
Instruction Fuzzy Hash: BE419C22A841587BDF214B64D8917BE7FA6AF81300F68C477E8869B382C6358D4087F2

Function 009D492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 009D4992

Part of subcall function 009F35AC: __lock.LIBCMT ref: 009F35B2
Part of subcall function 009F35AC: DecodePointer.KERNEL32(00000001,?,009D49A7,00A281BC), ref: 009F35BE
Part of subcall function 009F35AC: EncodePointer.KERNEL32(?,?,009D49A7,00A281BC), ref: 009F35C9

Part of subcall function 009D4A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 009D4A73
Part of subcall function 009D4A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 009D4A88

Part of subcall function 009D3B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 009D3B7A
Part of subcall function 009D3B4C: IsDebuggerPresent.KERNEL32 ref: 009D3B8C
Part of subcall function 009D3B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,00A962F8,00A962E0,?,?), ref: 009D3BFD
Part of subcall function 009D3B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 009D3C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 009D49D2

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 7ae80153d51067fa13cb1ae4188cf9412c879174cc62875c88e27853cc92a839
Instruction ID: ecfcba2d1e7460bd9b7b9daff34c91c34fed4286051bb970a1a6fea4372f3120
Opcode Fuzzy Hash: 7ae80153d51067fa13cb1ae4188cf9412c879174cc62875c88e27853cc92a839
Instruction Fuzzy Hash: A7118CB1A583119FC700EFA9EC05A5ABBE8EFD8710F00891FF045832A1DB709946CB96

Function 009D5DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,009D5981,?,?,?,?), ref: 009D5E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,009D5981,?,?,?,?), ref: 00A0E19C

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 15782a9e0afb2b1749abfdd76de6b4b3b0351c5ab6baeb340f6c71c7a48d95aa
Instruction ID: a33c0bf4acb4b235bf767152b302e68316b7ab6054bc1c3dea6f2989c9fc45cb
Opcode Fuzzy Hash: 15782a9e0afb2b1749abfdd76de6b4b3b0351c5ab6baeb340f6c71c7a48d95aa
Instruction Fuzzy Hash: BD01B570284708BEF3245E64DC8AF667B9CFB01768F10C719BAE55A2E0C6B41E45CB60

Function 009F0FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009F594C: __FF_MSGBANNER.LIBCMT ref: 009F5963
Part of subcall function 009F594C: __NMSG_WRITE.LIBCMT ref: 009F596A
Part of subcall function 009F594C: RtlAllocateHeap.NTDLL(01380000,00000000,00000001,00000000,?,?,?,009F1013,?), ref: 009F598F

std::exception::exception.LIBCMT ref: 009F102C
__CxxThrowException@8.LIBCMT ref: 009F1041

Part of subcall function 009F87DB: RaiseException.KERNEL32(?,?,?,00A8BAF8,00000000,?,?,?,?,009F1046,?,00A8BAF8,?,00000001), ref: 009F8830

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: e2bd547cf6acd1bd239a036c851958a6fd9b57cc77cf623394f9272fe92f4709
Instruction ID: 26517d9dce2216d151ac7ffb4fa0ed82b12b0ab318fe0ac7e377e9d253b705aa
Opcode Fuzzy Hash: e2bd547cf6acd1bd239a036c851958a6fd9b57cc77cf623394f9272fe92f4709
Instruction Fuzzy Hash: F1F0C83554061DF7CB24BA58EC05BFFB7ACAF41391F244426FA04A6592EFB18A8097E0

Function 009F582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 009F585C
__lock_file.LIBCMT ref: 009F587D

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 9037bfc2fb4c237b44f134d455841038adc0ac62d49d3db5d4e59bdb8614b50c
Instruction ID: 965305099e9c7128c15a942dd7f4255286688528c2886bdb97c7572dc1fc16bd
Opcode Fuzzy Hash: 9037bfc2fb4c237b44f134d455841038adc0ac62d49d3db5d4e59bdb8614b50c
Instruction Fuzzy Hash: CA018471800A0CEBCF12AF699C016BF7B65AFC03A0F158215BB245B1A1DB358A21DB91

Function 009F55D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009F8D68: __getptd_noexit.LIBCMT ref: 009F8D68

__lock_file.LIBCMT ref: 009F561B

Part of subcall function 009F6E4E: __lock.LIBCMT ref: 009F6E71

__fclose_nolock.LIBCMT ref: 009F5626

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: e667c5c890b700f3924d6b4bb45800bab89f1a2cfcc7bb0b4c0aa53c323ea10f
Instruction ID: 73fc13d028ffe41be5953b6086dd65afd5577209f8c0887c06655da26e3832de
Opcode Fuzzy Hash: e667c5c890b700f3924d6b4bb45800bab89f1a2cfcc7bb0b4c0aa53c323ea10f
Instruction Fuzzy Hash: C5F09072900A0C9BDB60AF75880277E66A16F80734F668209A724EB1C1CF7C89029B55

Function 0099129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00991ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00991AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00991B13

Memory Dump Source

Source File: 00000000.00000002.1648801357.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_arrival notice.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction ID: 07a62458f53f4ebdb9d18e275791dbc4d3eb055c4247c7606eb4080776b7d601
Opcode Fuzzy Hash: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction Fuzzy Hash: 3812BE24E18658C6EB24DF64D8507DEB232FF68300F1094E9910DEB7A5E77A4F81CB5A

Function 009E2123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baac84988e91cc438004bfc7d602ab60b347d4956ea46414d000c53d67e0667b
Instruction ID: b514a893791294251581ddcccfa9bc6128b412e0fc79120b0696fc56321c09ea
Opcode Fuzzy Hash: baac84988e91cc438004bfc7d602ab60b347d4956ea46414d000c53d67e0667b
Instruction Fuzzy Hash: 00519D34640614AFCF15EF68C991FAE77BAAF85310F158469F906AB382CB34EE00CB51

Function 009D5C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 009D5CF6

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d246d779c89118689fa79187405edc750d4347b884c71738a0b8c4ecef03e35a
Instruction ID: 409ffcaac31cc8be1ddb34beee96cd254dfbb1ab60739047d390636ce98b05a6
Opcode Fuzzy Hash: d246d779c89118689fa79187405edc750d4347b884c71738a0b8c4ecef03e35a
Instruction Fuzzy Hash: 17316C31A10B09AFCB18DF2DC484A6DB7B6FF88310F15C62AE81993750D771B960DB90

Function 00A100D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00A100E1

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 5dba8b7ae81d22baabfd2924a9a132cfc58f23f1159b6c93535550219537be14
Instruction ID: 6afd35da6bb4a18fdfc37970804040c1cb5d22efcbc64cc6c714680b8803e5e7
Opcode Fuzzy Hash: 5dba8b7ae81d22baabfd2924a9a132cfc58f23f1159b6c93535550219537be14
Instruction Fuzzy Hash: 18414574508341DFDB24DF14C484B1ABBE1BF85318F0989ADE8898B362C776EC85CB92

Function 009D4F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 009D4D13: FreeLibrary.KERNEL32(00000000,?), ref: 009D4D4D

Part of subcall function 009F548B: __wfsopen.LIBCMT ref: 009F5496

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00A962F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 009D4F6F

Part of subcall function 009D4CC8: FreeLibrary.KERNEL32(00000000), ref: 009D4D02

Part of subcall function 009D4DD0: _memmove.LIBCMT ref: 009D4E1A

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: ef3bf1ce148d3ade8c32b417866d38fcf3d3784913c28f86af97e8e167e9340a
Instruction ID: 15be8bc11590aecf32216a0132932ef0b2949cbd8b78d4805acdae6bdb3ee315
Opcode Fuzzy Hash: ef3bf1ce148d3ade8c32b417866d38fcf3d3784913c28f86af97e8e167e9340a
Instruction Fuzzy Hash: 92110A32680709ABCB20FF74DC02FAE77A59F84701F11C82EF585A63D1DE759A159750

Function 00A101AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00A101BB

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 361a8fb846163cd10e4795a3739ed39114ec7c1f889ab59400b0cc6a8bf9844b
Instruction ID: 41cd253244eb6c47471c9c09ce2f95eb38ce7a4452c73c77e08fd208d7c95316
Opcode Fuzzy Hash: 361a8fb846163cd10e4795a3739ed39114ec7c1f889ab59400b0cc6a8bf9844b
Instruction Fuzzy Hash: CA2122B4548341DFCB24DF54C444B5ABBE4BF88304F098969F98A47761D731E899CBA3

Function 009D5D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,009D5807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 009D5D76

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 24df74549cf7772b86e24811ab78391013b143295feaffa081a11d5eb7c36050
Instruction ID: 7d4161dba776f45ca2d2c45f0487f45b7be0b318fdc883b23ad8b65a75ee9891
Opcode Fuzzy Hash: 24df74549cf7772b86e24811ab78391013b143295feaffa081a11d5eb7c36050
Instruction Fuzzy Hash: B9113671240B059FE330CF15C888B62B7EAFF55760F11C92EE5AA86A90D7B0E945CF60

Function 009D7F41 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009D7F82

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 655c4edcc936791763e04923be4c22679df8ae5058c891d1c595f59b22235dd7
Instruction ID: d3f1fc1435f1dc92a5231f96274dc20d3127ec328bf7cde40ba5284dfc7ab09b
Opcode Fuzzy Hash: 655c4edcc936791763e04923be4c22679df8ae5058c891d1c595f59b22235dd7
Instruction Fuzzy Hash: B001D6722447056ED7305F68CC02F77FB98AB847A0F10862AF65ACA2D1EA31E4008790

Function 009F4A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 009F4AD6

Part of subcall function 009F8D68: __getptd_noexit.LIBCMT ref: 009F8D68

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 2c16137f8b5acb53ca5cc626f1a4c01234f9f582627d0f933827b863b37390e0
Instruction ID: 687c39c7ef74e8744d4cfb5b00f03e966e7caa9ea301c2653395099e2045a9b5
Opcode Fuzzy Hash: 2c16137f8b5acb53ca5cc626f1a4c01234f9f582627d0f933827b863b37390e0
Instruction Fuzzy Hash: A8F0C83194020DABDF91BF74CC063BF3669AF40325F144514F6249A1D1DB78C951DF51

Function 009D4FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00A962F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 009D4FDE

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ad29b69f82c476e00413ae98c906f1c031a49392a082d0f15177504800b3813c
Instruction ID: 218e644feb09408d614db3a17aa72b0b526025f5096efd1882269c79c13798b5
Opcode Fuzzy Hash: ad29b69f82c476e00413ae98c906f1c031a49392a082d0f15177504800b3813c
Instruction Fuzzy Hash: 5CF03971585B12CFCB349F68E894822BBE5BF04329320CA3FE2D682720C731A840DF40

Function 009F09D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 009F09F4

Part of subcall function 009D7D2C: _memmove.LIBCMT ref: 009D7D66

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: b62625d03715785734d10c87af1fc32b8b883b63d65a924fa2cb8bebdf1ade5d
Instruction ID: 8f55f859ea519ea01f0e47149a010872646b8965cca28674b003508ae6e354ed
Opcode Fuzzy Hash: b62625d03715785734d10c87af1fc32b8b883b63d65a924fa2cb8bebdf1ade5d
Instruction Fuzzy Hash: 6DE086769442285BC720E6989C05FFAB7EDDF89791F0441B6FC0CD7244E9609C818690

Function 00A39129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00A3914B

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: d61346a48863289f5b914de522ae7f5884e245dc24e0acb184a8b830e9845b08
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: 45E09AB0204B009FEB788B24D850BE373E0AB06315F00091CF2AAD3342EBA2B8418B59

Function 009D5DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,00A0E16B,?,?,00000000), ref: 009D5DBF

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1be289efe61f52361fa05d6da1a89a1cf00fff674a3e1eddfba30b284e1fb7f1
Instruction ID: 6ecb14ced48443fb91fa1c642866292afcb6e2825cb10e1e5d6f979a7f863f4b
Opcode Fuzzy Hash: 1be289efe61f52361fa05d6da1a89a1cf00fff674a3e1eddfba30b284e1fb7f1
Instruction Fuzzy Hash: 88D0C77464030CBFE710DB80DC46FAA777CE705711F100294FE0497290D6B27D508795

Function 009F548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 009F5496

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: ea2a2455133626b08a7ffec3992a0676af14a8e503997b0cc522bfbf11bb1043
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: D5B0927684020C77DE012E82EC02B693F199B80678F808020FB0C18172A673A6A09689

Function 00A3D2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00A3D46A

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: da42d4f24f1d1dca5b24f6ae0b1c968638d3ca8e1d05c46bce1b4616f47d4ab8
Instruction ID: 5efaa2967c1d0f83217dd6282f7708a9fa407a9b263f5d181fda4105e3b0873a
Opcode Fuzzy Hash: da42d4f24f1d1dca5b24f6ae0b1c968638d3ca8e1d05c46bce1b4616f47d4ab8
Instruction Fuzzy Hash: 94717231248702DFC714EF28D591B6AB7E0AF88314F04496DF4969B3A2DB30ED09CB52

Function 009F0E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 009F0EF7

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: d8b9aab6af00deb11d8867548d5ce4adc652601e3a17c1df37d7bd6e71195617
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 8131C571A00109DFC718DF58D480979F7AAFF99311B648AA5E50ACB652D731EDD1CBC0

Function 0099229C Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 009922B1

Memory Dump Source

Source File: 00000000.00000002.1648801357.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_arrival notice.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: 3cff0f71c40d47f420b414e03a454bf4539015aeb42110f194a264f1715453ef
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 87E0BF7494010EEFDB00EFA8D5496DE7BB4EF04311F1005A1FD05D7680DB319E548A62

Function 009922A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 009922B1

Memory Dump Source

Source File: 00000000.00000002.1648801357.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_990000_arrival notice.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 68dd16e31609cb80522dd68b93ffbc28323239cc5615cfb478154d6a37f34eb9
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: CBE0E67494010EEFDB00EFB8D54969E7FB4EF04301F1001A1FD01D2280D6319D508A72

Non-executed Functions

Function 00A5CDAC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 009D2612: GetWindowLongW.USER32(?,000000EB), ref: 009D2623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00A5CE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A5CE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00A5CED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A5CF00
SendMessageW.USER32 ref: 00A5CF29
_wcsncpy.LIBCMT ref: 00A5CFA1
GetKeyState.USER32(00000011), ref: 00A5CFC2
GetKeyState.USER32(00000009), ref: 00A5CFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A5CFE5
GetKeyState.USER32(00000010), ref: 00A5CFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A5D018
SendMessageW.USER32 ref: 00A5D03F
SendMessageW.USER32(?,00001030,?,00A5B602), ref: 00A5D145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00A5D15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00A5D16E
SetCapture.USER32(?), ref: 00A5D177
ClientToScreen.USER32(?,?), ref: 00A5D1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00A5D1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00A5D203
ReleaseCapture.USER32 ref: 00A5D20E
GetCursorPos.USER32(?), ref: 00A5D248
ScreenToClient.USER32(?,?), ref: 00A5D255
SendMessageW.USER32(?,00001012,00000000,?), ref: 00A5D2B1
SendMessageW.USER32 ref: 00A5D2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 00A5D31C
SendMessageW.USER32 ref: 00A5D34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00A5D36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00A5D37B
GetCursorPos.USER32(?), ref: 00A5D39B
ScreenToClient.USER32(?,?), ref: 00A5D3A8
GetParent.USER32(?), ref: 00A5D3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 00A5D431
SendMessageW.USER32 ref: 00A5D462
ClientToScreen.USER32(?,?), ref: 00A5D4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00A5D4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 00A5D51A
SendMessageW.USER32 ref: 00A5D53D
ClientToScreen.USER32(?,?), ref: 00A5D58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00A5D5C3

Part of subcall function 009D25DB: GetWindowLongW.USER32(?,000000EB), ref: 009D25EC

GetWindowLongW.USER32(?,000000F0), ref: 00A5D65F

Strings

@GUI_DRAGID, xrefs: 00A5D1AA
F, xrefs: 00A5D543

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: d6a7f7fd94d0b72393e9ce85ad44d5b297974371a04ac5c404b77e8635e3c1bb
Instruction ID: 7dbc89798fd11955e48714d933ca278b7095b36f32a3e03391a1f7e39428e0e9
Opcode Fuzzy Hash: d6a7f7fd94d0b72393e9ce85ad44d5b297974371a04ac5c404b77e8635e3c1bb
Instruction Fuzzy Hash: 2242AC70204341AFDB25CF68C884FAABBF5FF48366F14451DFA95972A0D731A849CB92

Function 00A5804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00A5873F

Strings

%d/%02d/%02d, xrefs: 00A58478

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: f849253306fdb1978dfef06fb79d493c78712f4382bf0edd1248c57274b09f84
Instruction ID: 9bab30ac4376d9206f4b6a2b751575fd1bca1b5c1fb4d7eecd58c46a2c179685
Opcode Fuzzy Hash: f849253306fdb1978dfef06fb79d493c78712f4382bf0edd1248c57274b09f84
Instruction Fuzzy Hash: C612AF71500248AFEB259F64CC49FAB7BB8FF89712F204169F915EA2A1DF788945CB10

Function 009E710E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009E75C2
_memset.LIBCMT ref: 009E76B1
_memmove.LIBCMT ref: 009E7C4B
_memmove.LIBCMT ref: 009E7E4F

Strings

DEFINE, xrefs: 00A225AF
Q\E, xrefs: 009E81C1
[:<:]], xrefs: 009E75F1
\b(?<=\w), xrefs: 00A23C41
\b(?=\w), xrefs: 00A23C34
[:>:]], xrefs: 009E760A

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: ac33bf5d41a7e8ca6a1a0730dd03d01b0a4192a6a8ff227b0667c48487442ca8
Instruction ID: df0c2af06c90d9c5ee0a2ed09dea9c2f63ba225bf1ad4c6ed03eeeecf5f7676d
Opcode Fuzzy Hash: ac33bf5d41a7e8ca6a1a0730dd03d01b0a4192a6a8ff227b0667c48487442ca8
Instruction Fuzzy Hash: 6093B071A00229DFDF25CF9DD881BADB7B1FF48710F25856AE945AB280E7749E81CB40

Function 009D4A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 009D4A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A0DA8E
IsIconic.USER32(?), ref: 00A0DA97
ShowWindow.USER32(?,00000009), ref: 00A0DAA4
SetForegroundWindow.USER32(?), ref: 00A0DAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00A0DAC4
GetCurrentThreadId.KERNEL32 ref: 00A0DACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 00A0DAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 00A0DAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 00A0DAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 00A0DAF8
SetForegroundWindow.USER32(?), ref: 00A0DAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A0DB10
keybd_event.USER32(00000012,00000000), ref: 00A0DB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A0DB25
keybd_event.USER32(00000012,00000000), ref: 00A0DB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A0DB33
keybd_event.USER32(00000012,00000000), ref: 00A0DB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A0DB42
keybd_event.USER32(00000012,00000000), ref: 00A0DB47
SetForegroundWindow.USER32(?), ref: 00A0DB4A
AttachThreadInput.USER32(?,?,00000000), ref: 00A0DB71

Strings

Shell_TrayWnd, xrefs: 00A0DA89

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: e1160130b59bf8dc816ac39a0dd6e8d0ba36d5f51d108092cff108b2d9bb6144
Instruction ID: ce8686ec677f643e682648accde5cc963dc4485ffd34808e715363a0a5b071a7
Opcode Fuzzy Hash: e1160130b59bf8dc816ac39a0dd6e8d0ba36d5f51d108092cff108b2d9bb6144
Instruction Fuzzy Hash: 8C312F72A80318BFEB21AFE19C49F7F7E6CEB44B51F114065FA05EB1D1D6B05901AAA0

Function 00A28858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00A28CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A28D0D
Part of subcall function 00A28CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A28D3A
Part of subcall function 00A28CC3: GetLastError.KERNEL32 ref: 00A28D47

_memset.LIBCMT ref: 00A2889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00A288ED
CloseHandle.KERNEL32(?), ref: 00A288FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00A28915
GetProcessWindowStation.USER32 ref: 00A2892E
SetProcessWindowStation.USER32(00000000), ref: 00A28938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00A28952

Part of subcall function 00A28713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A28851), ref: 00A28728
Part of subcall function 00A28713: CloseHandle.KERNEL32(?,?,00A28851), ref: 00A2873A

Strings

default, xrefs: 00A2894D
, xrefs: 00A288AA
winsta0, xrefs: 00A28910

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 6bba71c79e64907c5f67eec19e4a021e46340b7cc10243307ae20ff27010ea7c
Instruction ID: 3b63ff1543289a9af309237895e91081d0d60897a40c6def53137b8e198bb41d
Opcode Fuzzy Hash: 6bba71c79e64907c5f67eec19e4a021e46340b7cc10243307ae20ff27010ea7c
Instruction Fuzzy Hash: 27817A71802219AFDF11DFA8ED45AEEBBB8FF04345F08412AF910A6161DF398E15DB60

Function 00A4425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00A5F910), ref: 00A44284
IsClipboardFormatAvailable.USER32(0000000D), ref: 00A44292
GetClipboardData.USER32(0000000D), ref: 00A4429A
CloseClipboard.USER32 ref: 00A442A6
GlobalLock.KERNEL32(00000000), ref: 00A442C2
CloseClipboard.USER32 ref: 00A442CC
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00A442E1
IsClipboardFormatAvailable.USER32(00000001), ref: 00A442EE
GetClipboardData.USER32(00000001), ref: 00A442F6
GlobalLock.KERNEL32(00000000), ref: 00A44303
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 00A44337
CloseClipboard.USER32 ref: 00A44447

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 8e29d11826777052c522457f42604181ae51694649ec9b5840aa7110918dffb3
Instruction ID: da53f1ea444e7469f9fb437e01f254b5bfcab74da833a964cb457c3b0d564885
Opcode Fuzzy Hash: 8e29d11826777052c522457f42604181ae51694649ec9b5840aa7110918dffb3
Instruction Fuzzy Hash: 22518F75244302AFD301EFA4EC86FBE77A8BFC8B01F10452AF556D62A1DB70D9058B62

Function 00A3C9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A3C9F8
FindClose.KERNEL32(00000000), ref: 00A3CA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A3CA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A3CA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 00A3CAAF
__swprintf.LIBCMT ref: 00A3CAFB
__swprintf.LIBCMT ref: 00A3CB3E

Part of subcall function 009D7F41: _memmove.LIBCMT ref: 009D7F82

__swprintf.LIBCMT ref: 00A3CB92

Part of subcall function 009F38D8: __woutput_l.LIBCMT ref: 009F3931

__swprintf.LIBCMT ref: 00A3CBE0

Part of subcall function 009F38D8: __flsbuf.LIBCMT ref: 009F3953
Part of subcall function 009F38D8: __flsbuf.LIBCMT ref: 009F396B

__swprintf.LIBCMT ref: 00A3CC2F
__swprintf.LIBCMT ref: 00A3CC7E
__swprintf.LIBCMT ref: 00A3CCCD

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00A3CAF5
%4d, xrefs: 00A3CB38
%02d, xrefs: 00A3CB86, 00A3CB90, 00A3CBDE, 00A3CC2D, 00A3CC7C, 00A3CCCB

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 8443b32040185182cbdbc81437a54000636c11a563bb14b783816bdbddb6d419
Instruction ID: c95711488aea5561a643e461dc2b4e8c224ff7707c03b3a23d1280cb4dbc214b
Opcode Fuzzy Hash: 8443b32040185182cbdbc81437a54000636c11a563bb14b783816bdbddb6d419
Instruction Fuzzy Hash: 65A12FB2548305ABC710FBA4CD85EAFB7ECBF94704F40891AB585D7291EA34DA08C762

Function 00A3F200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00A3F221
_wcscmp.LIBCMT ref: 00A3F236
_wcscmp.LIBCMT ref: 00A3F24D
GetFileAttributesW.KERNEL32(?), ref: 00A3F25F
SetFileAttributesW.KERNEL32(?,?), ref: 00A3F279
FindNextFileW.KERNEL32(00000000,?), ref: 00A3F291
FindClose.KERNEL32(00000000), ref: 00A3F29C
FindFirstFileW.KERNEL32(*.*,?), ref: 00A3F2B8
_wcscmp.LIBCMT ref: 00A3F2DF
_wcscmp.LIBCMT ref: 00A3F2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 00A3F308
SetCurrentDirectoryW.KERNEL32(00A8A5A0), ref: 00A3F326
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A3F330
FindClose.KERNEL32(00000000), ref: 00A3F33D
FindClose.KERNEL32(00000000), ref: 00A3F34F

Strings

*.*, xrefs: 00A3F2B3

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 60bb50573df7f8393dcd99e694cfac2dd51e31feaa14aa3f1bfe09205b323a7e
Instruction ID: 717a7ea6a2b62613741849121c1cab061a88043d1fd7c25e254c85975afcc582
Opcode Fuzzy Hash: 60bb50573df7f8393dcd99e694cfac2dd51e31feaa14aa3f1bfe09205b323a7e
Instruction Fuzzy Hash: 7A31A376901219BEDB10EBF4EC49AEE73ACAF48361F144576F924D70A0EB34DA45CB50

Function 00A50AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A50BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,00A5F910,00000000,?,00000000,?,?), ref: 00A50C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00A50C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00A50D1D
RegCloseKey.ADVAPI32(?), ref: 00A5103D
RegCloseKey.ADVAPI32(00000000), ref: 00A5104A

Strings

REG_SZ, xrefs: 00A50D5B
REG_MULTI_SZ, xrefs: 00A50E05
REG_QWORD, xrefs: 00A50F8B
REG_EXPAND_SZ, xrefs: 00A50CBA
REG_BINARY, xrefs: 00A50FD8
REG_DWORD, xrefs: 00A50F0E

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 9f8c6797aaeb9ce39c11ef567b52f746cc569b61703d7f8e577c3aadb40281d3
Instruction ID: d09c5fe46039e18038b857753132d70c4d460411d17bcd738198edd8cd2da564
Opcode Fuzzy Hash: 9f8c6797aaeb9ce39c11ef567b52f746cc569b61703d7f8e577c3aadb40281d3
Instruction Fuzzy Hash: BB0229752046119FCB14EF18C895F2AB7E5BF88714F04885DF88A9B3A2DB34ED45CB81

Function 00A3F35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00A3F37E
_wcscmp.LIBCMT ref: 00A3F393
_wcscmp.LIBCMT ref: 00A3F3AA

Part of subcall function 00A345C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00A345DC

FindNextFileW.KERNEL32(00000000,?), ref: 00A3F3D9
FindClose.KERNEL32(00000000), ref: 00A3F3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 00A3F400
_wcscmp.LIBCMT ref: 00A3F427
_wcscmp.LIBCMT ref: 00A3F43E
SetCurrentDirectoryW.KERNEL32(?), ref: 00A3F450
SetCurrentDirectoryW.KERNEL32(00A8A5A0), ref: 00A3F46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A3F478
FindClose.KERNEL32(00000000), ref: 00A3F485
FindClose.KERNEL32(00000000), ref: 00A3F497

Strings

*.*, xrefs: 00A3F3FB

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 88bdd3c16bbda713125ba2177476f14a804b3617602375914e70492a14ce89c8
Instruction ID: 45dcaedfdd55a1605cccfa9b62c268b9d9d0b69282bc60b495918c818c92588f
Opcode Fuzzy Hash: 88bdd3c16bbda713125ba2177476f14a804b3617602375914e70492a14ce89c8
Instruction Fuzzy Hash: EF31D5729012197EDF10EBA4EC88AEF77ACAF49321F104275F920A30A0D734DE85CB50

Function 00A281F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A2874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A28766
Part of subcall function 00A2874A: GetLastError.KERNEL32(?,00A2822A,?,?,?), ref: 00A28770
Part of subcall function 00A2874A: GetProcessHeap.KERNEL32(00000008,?,?,00A2822A,?,?,?), ref: 00A2877F
Part of subcall function 00A2874A: HeapAlloc.KERNEL32(00000000,?,00A2822A,?,?,?), ref: 00A28786
Part of subcall function 00A2874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A2879D

Part of subcall function 00A287E7: GetProcessHeap.KERNEL32(00000008,00A28240,00000000,00000000,?,00A28240,?), ref: 00A287F3
Part of subcall function 00A287E7: HeapAlloc.KERNEL32(00000000,?,00A28240,?), ref: 00A287FA
Part of subcall function 00A287E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00A28240,?), ref: 00A2880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00A2825B
_memset.LIBCMT ref: 00A28270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00A2828F
GetLengthSid.ADVAPI32(?), ref: 00A282A0
GetAce.ADVAPI32(?,00000000,?), ref: 00A282DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00A282F9
GetLengthSid.ADVAPI32(?), ref: 00A28316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00A28325
HeapAlloc.KERNEL32(00000000), ref: 00A2832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00A2834D
CopySid.ADVAPI32(00000000), ref: 00A28354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00A28385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00A283AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00A283BF

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 2b47be9a7ca0501074fb47d08ade587009429acd2d0b122741798aa0ee4ea37d
Instruction ID: 22ad71afc18db2924cfa696fb065206ca2c1577ecfc285b33021779c813d1eba
Opcode Fuzzy Hash: 2b47be9a7ca0501074fb47d08ade587009429acd2d0b122741798aa0ee4ea37d
Instruction Fuzzy Hash: FD616E71901219EFDF00DFA8ED44AEEBBB9FF04701F188129F915AB291DB359A05DB60

Function 009E6843 Relevance: 18.4, Strings: 14, Instructions: 883COMMON

Download Yara Rule

Strings

UCP), xrefs: 00A21546
NO_START_OPT), xrefs: 00A21588
CRLF), xrefs: 00A216FA
BSR_UNICODE), xrefs: 00A21771
ANYCRLF), xrefs: 00A21734
LIMIT_RECURSION=, xrefs: 00A21635
LIMIT_MATCH=, xrefs: 00A215A9
CR), xrefs: 00A216C0
UTF16), xrefs: 00A21508
UTF), xrefs: 00A21533
ANY), xrefs: 00A21717
BSR_ANYCRLF), xrefs: 00A21757
LF), xrefs: 00A216DD
NO_AUTO_POSSESS), xrefs: 00A21567

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: e3547d8b2ce0b7405878335bc2994bdae35c00045f19bc8f7971cc547c3e1eef
Instruction ID: 6ad22dc3773b630c6aef2fc26531726fa7fd03c54294f430173d4bd87c8c2dc0
Opcode Fuzzy Hash: e3547d8b2ce0b7405878335bc2994bdae35c00045f19bc8f7971cc547c3e1eef
Instruction Fuzzy Hash: 1872A371E00269DBDF25CF59D8807AEB7B5FF68350F14816AE949EB280E7349D81CB90

Function 00A50665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A510A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A50038,?,?), ref: 00A510BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A50737

Part of subcall function 009D9997: __itow.LIBCMT ref: 009D99C2
Part of subcall function 009D9997: __swprintf.LIBCMT ref: 009D9A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00A507D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00A5086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00A50AAD
RegCloseKey.ADVAPI32(00000000), ref: 00A50ABA

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 212047c8da9d93df9eef24093a0766f436fe25171aedd6613b9e8567f88108e5
Instruction ID: e0b84aa46926b9f57926a2f3daee88e064f73af82f91ce2f895757df5b0c2fc3
Opcode Fuzzy Hash: 212047c8da9d93df9eef24093a0766f436fe25171aedd6613b9e8567f88108e5
Instruction Fuzzy Hash: C2E14C71204710AFCB14DF29C895E2ABBF4FF89714B04896DF94ADB2A2DA30ED05CB51

Function 00A30219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00A30241
GetAsyncKeyState.USER32(000000A0), ref: 00A302C2
GetKeyState.USER32(000000A0), ref: 00A302DD
GetAsyncKeyState.USER32(000000A1), ref: 00A302F7
GetKeyState.USER32(000000A1), ref: 00A3030C
GetAsyncKeyState.USER32(00000011), ref: 00A30324
GetKeyState.USER32(00000011), ref: 00A30336
GetAsyncKeyState.USER32(00000012), ref: 00A3034E
GetKeyState.USER32(00000012), ref: 00A30360
GetAsyncKeyState.USER32(0000005B), ref: 00A30378
GetKeyState.USER32(0000005B), ref: 00A3038A

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: b36526ff0a84389bdf20c30bc4560882b78defd0b08a87dcc8d8cab21729f83c
Instruction ID: 1a8a0f775c9248efe8e1ce63fc0b5e2ca484738a40ae07842e44b49ac3afd5ca
Opcode Fuzzy Hash: b36526ff0a84389bdf20c30bc4560882b78defd0b08a87dcc8d8cab21729f83c
Instruction Fuzzy Hash: 314189645047C96EFF719BE48828BE6BEA07F11344F08409DE6C64B1C2E7E459C4C7A2

Function 00A486D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 009D9997: __itow.LIBCMT ref: 009D99C2
Part of subcall function 009D9997: __swprintf.LIBCMT ref: 009D9A0C

CoInitialize.OLE32 ref: 00A48718
CoUninitialize.OLE32 ref: 00A48723
CoCreateInstance.OLE32(?,00000000,00000017,00A62BEC,?), ref: 00A48783
IIDFromString.OLE32(?,?), ref: 00A487F6
VariantInit.OLEAUT32(?), ref: 00A48890
VariantClear.OLEAUT32(?), ref: 00A488F1

Strings

Failed to create object, xrefs: 00A4878E, 00A48844
NULL Pointer assignment, xrefs: 00A487C8
Invalid parameter, xrefs: 00A4880F

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 369816c0f944b2cdd360644e4284c1e19ab448a312ae5c671e45434afbc4e1ec
Instruction ID: e0ac7813ffb0e756b0d4af7c77cfcb8978c09ef6703170c43c906a2430382738
Opcode Fuzzy Hash: 369816c0f944b2cdd360644e4284c1e19ab448a312ae5c671e45434afbc4e1ec
Instruction Fuzzy Hash: 3161B074608301AFD710EF64D988B6FBBE8AF88754F10481DF9859B291CB74ED44CB92

Function 00A44458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00A4447F
EmptyClipboard.USER32 ref: 00A44485
GlobalAlloc.KERNEL32(00000002,?), ref: 00A4449A
CloseClipboard.USER32 ref: 00A44539

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 2170b9a243021bed006c56c451b1e5dcde457fbd3a0b1445cfa3a9993edf9f2d
Instruction ID: 25cef0f2fac034b27b7ba955e8ba233122f91084e35e1cbaf8cf30f433489b9c
Opcode Fuzzy Hash: 2170b9a243021bed006c56c451b1e5dcde457fbd3a0b1445cfa3a9993edf9f2d
Instruction Fuzzy Hash: B62153393012209FDB10EFA4EC49B6E77A8FF88711F108026F946DB2A1DB74AD01CB55

Function 00A33A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009D48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009D48A1,?,?,009D37C0,?), ref: 009D48CE

Part of subcall function 00A34CD3: GetFileAttributesW.KERNEL32(?,00A33947), ref: 00A34CD4

FindFirstFileW.KERNEL32(?,?), ref: 00A33ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00A33B87
MoveFileW.KERNEL32(?,?), ref: 00A33B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00A33BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A33BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00A33BF5

Strings

\*.*, xrefs: 00A33A8A, 00A33A93, 00A33AA8

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: f66706b1683ea351fc45b61fa1c01cb6a94d8bd108d43cb6493df0b8808c8932
Instruction ID: aa520eb8b0dabdf84a488770f6ed47b728a7081a97a9df3e204b6afefb14d67e
Opcode Fuzzy Hash: f66706b1683ea351fc45b61fa1c01cb6a94d8bd108d43cb6493df0b8808c8932
Instruction Fuzzy Hash: 815140328492599ACF15EBE0CE92AEDF779AF54300F64816AF44277191EF316F09CB60

Function 00A3F65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 009D7F41: _memmove.LIBCMT ref: 009D7F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00A3F6AB
Sleep.KERNEL32(0000000A), ref: 00A3F6DB
_wcscmp.LIBCMT ref: 00A3F6EF
_wcscmp.LIBCMT ref: 00A3F70A
FindNextFileW.KERNEL32(?,?), ref: 00A3F7A8
FindClose.KERNEL32(00000000), ref: 00A3F7BE

Strings

*.*, xrefs: 00A3F690

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: f66fec4ab64ad7abf9290cab1ba59be7a6bd93819e46879f17f44f6d0ef45ac9
Instruction ID: c5ecd3fe5178d4ea07ff4e15d765c45b56ea807f37f20cee9ffa2f8fa478f2ca
Opcode Fuzzy Hash: f66fec4ab64ad7abf9290cab1ba59be7a6bd93819e46879f17f44f6d0ef45ac9
Instruction Fuzzy Hash: 7D414C7195021AAFDF15EFA4CC85AEEBBB4BF45310F144566F815A22A1EB309E44CBA0

Function 009E4140 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1132COMMON

Download Yara Rule

Strings

VUUU, xrefs: 009E4520
VUUU, xrefs: 00A17B0C
VUUU, xrefs: 009E44ED
VUUU, xrefs: 009E44DB
ERCP, xrefs: 009E421F

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 5aa0307edf0a5a0b21df7993c9e6f8879cdaf1ce8dc04b930ea7cd46dc5ec724
Instruction ID: 984149c56f7682d6086ebf2ce121fb2271950506f5c9824bf9769fb91e6a53cb
Opcode Fuzzy Hash: 5aa0307edf0a5a0b21df7993c9e6f8879cdaf1ce8dc04b930ea7cd46dc5ec724
Instruction Fuzzy Hash: 0BA27D74E0425ACBDF25CF59C9807EEB7B1BB54314F2485AAD856A7280E7349EC1CF80

Function 009E58C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009E5A05
_memmove.LIBCMT ref: 009E5A55
_memmove.LIBCMT ref: 009E5ABB

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: c324ca1fd83252f4d4ca4054613e26cd20bdf240f8666e58aa76a578dbddc663
Instruction ID: 38e1b07c4a2c9b71769a42a79d4ddfce1800ca14f2ff3464445c1af0d335d886
Opcode Fuzzy Hash: c324ca1fd83252f4d4ca4054613e26cd20bdf240f8666e58aa76a578dbddc663
Instruction Fuzzy Hash: 39129B70A00619EFDF14DFA9D981AAEB7F5FF88304F148529E406E7292EB35AD11CB50

Function 00A3545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00A28CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A28D0D
Part of subcall function 00A28CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A28D3A
Part of subcall function 00A28CC3: GetLastError.KERNEL32 ref: 00A28D47

ExitWindowsEx.USER32(?,00000000), ref: 00A3549B

Strings

SeShutdownPrivilege, xrefs: 00A3546B
, xrefs: 00A35489
@, xrefs: 00A3548E

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 6ecb4317f6a8b643910a49015b18f21a8bdef1a298bd8e9e12cba08f8b917caf
Instruction ID: 83cde1818a43cdd658167b9ff6e95a83551efa025a4293608eacc4e45bd0fbcc
Opcode Fuzzy Hash: 6ecb4317f6a8b643910a49015b18f21a8bdef1a298bd8e9e12cba08f8b917caf
Instruction Fuzzy Hash: 8501F771E55B116EE72CA77CEC4ABBA7269EB05353F240531FD07D60D3EAA45C808590

Function 00A46596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00A465EF
WSAGetLastError.WSOCK32(00000000), ref: 00A465FE
bind.WSOCK32(00000000,?,00000010), ref: 00A4661A
listen.WSOCK32(00000000,00000005), ref: 00A46629
WSAGetLastError.WSOCK32(00000000), ref: 00A46643
closesocket.WSOCK32(00000000,00000000), ref: 00A46657

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 5400d64ff07e25d059c45ab1991d9f3ff8b2e66d41fbbd3df49a4f599a41ff98
Instruction ID: d6d91340bfab92a31f6ddfe8d5ea20f7089edda8786b147f32851fafe983597e
Opcode Fuzzy Hash: 5400d64ff07e25d059c45ab1991d9f3ff8b2e66d41fbbd3df49a4f599a41ff98
Instruction Fuzzy Hash: E121D035200210AFCB04FF68D945B6EB7B9EF89321F11816AF956A73D1CB70AD01CB51

Function 009E5680 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 009F0FF6: std::exception::exception.LIBCMT ref: 009F102C
Part of subcall function 009F0FF6: __CxxThrowException@8.LIBCMT ref: 009F1041

_memmove.LIBCMT ref: 00A2062F
_memmove.LIBCMT ref: 00A20744
_memmove.LIBCMT ref: 00A207EB

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 3ec5515d78016c9ef819ff7fe6b5c945a1124aa1d1558f46849f446bde0e6afe
Instruction ID: a849bd1e7a8f3a8e83b2eeac0fe5cfcdcb7834eacef99642a459e1ddeae8820f
Opcode Fuzzy Hash: 3ec5515d78016c9ef819ff7fe6b5c945a1124aa1d1558f46849f446bde0e6afe
Instruction Fuzzy Hash: F1029FB0A00219DFDF04DF69E981AAEBBB5FF84300F158069E806DB256EB35DD51CB91

Function 009D1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 009D2612: GetWindowLongW.USER32(?,000000EB), ref: 009D2623

DefDlgProcW.USER32(?,?,?,?,?), ref: 009D19FA
GetSysColor.USER32(0000000F), ref: 009D1A4E
SetBkColor.GDI32(?,00000000), ref: 009D1A61

Part of subcall function 009D1290: DefDlgProcW.USER32(?,00000020,?), ref: 009D12D8

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 0a6d559bfe1c0f9fe1a9e1484c0ddd43fc74addef6d3a22872b77af9e6a12d2a
Instruction ID: d87d2de8776c047184a2f590f279c375105b4ece749e5c57349857f359417b96
Opcode Fuzzy Hash: 0a6d559bfe1c0f9fe1a9e1484c0ddd43fc74addef6d3a22872b77af9e6a12d2a
Instruction Fuzzy Hash: 1AA16A73295548BEE628AB686E54E7F359CEF46342F14851BF402D63E9CE28CD01D2B1

Function 00A46A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A480A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00A480CB

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00A46AB1
WSAGetLastError.WSOCK32(00000000), ref: 00A46ADA
bind.WSOCK32(00000000,?,00000010), ref: 00A46B13
WSAGetLastError.WSOCK32(00000000), ref: 00A46B20
closesocket.WSOCK32(00000000,00000000), ref: 00A46B34

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 3be9ec4b529930abc45e4ba08adaa4720bd1de4f3f177a182946fa5c4c8f97d5
Instruction ID: 24a5e82cd8e112ad455b9713b60725b08b7f8d10eeca8b943a773fcb8b8dfa3a
Opcode Fuzzy Hash: 3be9ec4b529930abc45e4ba08adaa4720bd1de4f3f177a182946fa5c4c8f97d5
Instruction Fuzzy Hash: 3141A575640210AFEB10BF68DC86F6E77A9EB85710F04C059F95AAB3D2DA705D018B91

Function 00A555FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00A5564C
IsWindowEnabled.USER32 ref: 00A5565A
GetForegroundWindow.USER32(?,?,00000001), ref: 00A55667
IsIconic.USER32 ref: 00A55675
IsZoomed.USER32 ref: 00A55683

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: b55dcbb2129108f8d593021a205837bcb4fd9ec26e5bae700934e29a9f6fd23c
Instruction ID: f6c1954e382d127516e373c1198442918081c0d4410ec476e37ec0c22a7ba016
Opcode Fuzzy Hash: b55dcbb2129108f8d593021a205837bcb4fd9ec26e5bae700934e29a9f6fd23c
Instruction Fuzzy Hash: FD11C831B406506FD7116F76DC64B2FB7A9FF94722B894029FC06D7641DB3099028A95

Function 00A4C304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00A11D88,?), ref: 00A4C312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00A4C324

Strings

kernel32.dll, xrefs: 00A4C30D
GetSystemWow64DirectoryW, xrefs: 00A4C31E

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 8fd567a2e97481c090d8595b74f5bd3216b35d870144b56d0154ae7399a99226
Instruction ID: bfabc55205586fb660e6d88f725eb51706dd9f032eb4d73636d2a6fa53505063
Opcode Fuzzy Hash: 8fd567a2e97481c090d8595b74f5bd3216b35d870144b56d0154ae7399a99226
Instruction Fuzzy Hash: 22E01278611713DFDB609F65D804A46B6E4FF48766F80C839E999DA2A0E770F841CB60

Function 009E3190 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 08c309265f9d2b7879836a9257b4b2d0e1e1b184513f5bdfea0615fbb47a3594
Instruction ID: 09c70ac01123c9d6269b6bcce330154fbb1917bc335a23a308885161f262ee5d
Opcode Fuzzy Hash: 08c309265f9d2b7879836a9257b4b2d0e1e1b184513f5bdfea0615fbb47a3594
Instruction Fuzzy Hash: 282289716083419FC725EF25C885BAEB7E4AF84704F10892DF99A97391DB70EE44CB92

Function 00A4F121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00A4F151
Process32FirstW.KERNEL32(00000000,?), ref: 00A4F15F

Part of subcall function 009D7F41: _memmove.LIBCMT ref: 009D7F82

Process32NextW.KERNEL32(00000000,?), ref: 00A4F21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00A4F22E

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 2d533fb0c63649ca4a532ee2cf633b3142685e4f5718fa1d279359bb605fba4b
Instruction ID: 6eff1cd6359546cdf437c52688309ae3324fa38e08f78bf1d331788c48d2e48f
Opcode Fuzzy Hash: 2d533fb0c63649ca4a532ee2cf633b3142685e4f5718fa1d279359bb605fba4b
Instruction Fuzzy Hash: 59515B71504711AFD310EF24DC85B6BB7E8BFD4750F10892EF596972A2EB70A904CB92

Function 00A340B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00A340D1
_memset.LIBCMT ref: 00A340F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00A34144
CloseHandle.KERNEL32(00000000), ref: 00A3414D

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: ea7392a02608edc827428c1594d8ac080fce7adb6413b2d6068cb038cc7298ed
Instruction ID: 85c0257fdc402732c3573c715070932c52ee160a0dcfb7bbc1bcef285fce5057
Opcode Fuzzy Hash: ea7392a02608edc827428c1594d8ac080fce7adb6413b2d6068cb038cc7298ed
Instruction Fuzzy Hash: CE11A7759013287AE7309BA5AC4DFABBB7CEF45760F1042AAF908D7190D6745E808BA4

Function 00A2EB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00A2EB19

Strings

|, xrefs: 00A2EB49
(, xrefs: 00A2EB5F

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: c106988abf878dd64f79deff80b70af8d7a281c43709addda5ee70a8b4ffaf2b
Instruction ID: 3c130a1e7dbe191d2a88f5cb85c28385cd225ae2ad020685c0074472092ade4b
Opcode Fuzzy Hash: c106988abf878dd64f79deff80b70af8d7a281c43709addda5ee70a8b4ffaf2b
Instruction Fuzzy Hash: 41323575A047159FCB28CF19D481A6AB7F0FF48320B15C56EE89ADB3A1E770E981CB40

Function 00A425E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 00A426D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00A4270C

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: a9d22b67128ad3561234b3aeb5d3c0ed8378ba2ee767370f7f82503335a55641
Instruction ID: cdc488e75fac4d5b53da36b05bc2424d9b094f53c2ba6870ccf6f55c38a0a776
Opcode Fuzzy Hash: a9d22b67128ad3561234b3aeb5d3c0ed8378ba2ee767370f7f82503335a55641
Instruction Fuzzy Hash: 1F41E479900309BFEB20DF94DC85FBBB7BCEBC0764F50406AFA01A6141EA71AE419764

Function 00A3B59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A3B5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00A3B608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00A3B655

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: bf7dbe86c95687e3d31150d71e87d21b699e04aa6e10e89afff3e51096fc35eb
Instruction ID: 642b1cca3a44f047dbbf77ba5004820ee1c05c5f4c73b969fb901cec2f9359a7
Opcode Fuzzy Hash: bf7dbe86c95687e3d31150d71e87d21b699e04aa6e10e89afff3e51096fc35eb
Instruction Fuzzy Hash: C0217435A10618EFCB00EF95D881EEDBBB8FF48310F1480AAF945AB351DB319916CB51

Function 00A28CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 009F0FF6: std::exception::exception.LIBCMT ref: 009F102C
Part of subcall function 009F0FF6: __CxxThrowException@8.LIBCMT ref: 009F1041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A28D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A28D3A
GetLastError.KERNEL32 ref: 00A28D47

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 8333694e9ba4f4cf1593b5f0326bc3ca776ee1e58af4ff604c0f82408c058e0e
Instruction ID: e529d6618402254fb2dfdca18de47bfe3d9f0606bce4c8470632f7b8ad2f7497
Opcode Fuzzy Hash: 8333694e9ba4f4cf1593b5f0326bc3ca776ee1e58af4ff604c0f82408c058e0e
Instruction Fuzzy Hash: E1118FB1414309AFE728EF58EC85D6BB7BCFB44711B24852EF85697681EB30AC418B60

Function 00A34C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00A34C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00A34C43
FreeSid.ADVAPI32(?), ref: 00A34C53

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 7422159a3b800e865bc4c2ece647fde93e2661c09d33ac1ae201547b5006ec84
Instruction ID: 1efd5db2cbe964caef7a2a291bd06356ceca642e1a55fb634a1e85ddb9197927
Opcode Fuzzy Hash: 7422159a3b800e865bc4c2ece647fde93e2661c09d33ac1ae201547b5006ec84
Instruction Fuzzy Hash: 56F0F975A5130DBFDF04DFF4DD89AAEBBBCFF08212F5044A9A902E2181E6756A448B50

Function 009DE060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fcfe3989913f02df8476dd7b4793c4c2dec1f4600d2c310875e46febfa9d28a
Instruction ID: 8185b47f70eaa48d9f77ceb9ea97b4495c6b0b9cade6d20f5195fe95f8ceecb1
Opcode Fuzzy Hash: 1fcfe3989913f02df8476dd7b4793c4c2dec1f4600d2c310875e46febfa9d28a
Instruction Fuzzy Hash: B122BB75A4421ACFCB24EF58C480ABEB7B4FF48300F14C56AE956AF351E734A985CB91

Function 00A3C93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A3C966
FindClose.KERNEL32(00000000), ref: 00A3C996

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c4df03ddc128b6bb4813a5a841713bb98bacc2751f8ea92fb4a7ef496005817a
Instruction ID: 3ee924eba372e2c16803e80bead2874671edaea7a5fde190972988bf36afba8f
Opcode Fuzzy Hash: c4df03ddc128b6bb4813a5a841713bb98bacc2751f8ea92fb4a7ef496005817a
Instruction Fuzzy Hash: 18115E726106109FD710EF29D845A2AF7E9FF84325F01891EF9A9DB3A1DB34AC01CB81

Function 00A3A2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00A4977D,?,00A5FB84,?), ref: 00A3A302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00A4977D,?,00A5FB84,?), ref: 00A3A314

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 6c894ae071227d8e5a8279eed5a29b38a1c20f89d88d864585d8b8dceb48eed4
Instruction ID: 6d59d20cb3e26eeb842e31f4a806dff83c15391f85159af58d062c4e0d43edb7
Opcode Fuzzy Hash: 6c894ae071227d8e5a8279eed5a29b38a1c20f89d88d864585d8b8dceb48eed4
Instruction Fuzzy Hash: 69F0823564532DBBEB20EFA4CC48FEAB76DBF09761F008166B919D7181D6309940CBA1

Function 00A28713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A28851), ref: 00A28728
CloseHandle.KERNEL32(?,?,00A28851), ref: 00A2873A

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: d09773dde81136bac4e1b6d976d9d39f2925b9471aa55710dc8f1c68e5139a08
Instruction ID: 70289e4f4598c7a0ca79ddcf4f0b12eb84904686fe3025d3a72f0842b56c4180
Opcode Fuzzy Hash: d09773dde81136bac4e1b6d976d9d39f2925b9471aa55710dc8f1c68e5139a08
Instruction Fuzzy Hash: 4FE0B676011610EEEB252B64FC09E777BA9FB443657288839B99680470DB72AC91DB50

Function 009FA395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,009F8F97,?,?,?,00000001), ref: 009FA39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 009FA3A3

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 447abb14eee555ca2f3a32750b67e4fe63714f9f4f0b4f88d659b2b7a80a8d0b
Instruction ID: 9b87c22e10355d060773a71d76a5fe7841568c9dfbc28d852048fbe4a89615b8
Opcode Fuzzy Hash: 447abb14eee555ca2f3a32750b67e4fe63714f9f4f0b4f88d659b2b7a80a8d0b
Instruction Fuzzy Hash: 8FB09271054308AFEA006FD1ED09B893F68FB44AB3F404020F61D88070CB7254528A91

Function 009FF419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c1732006bdadc0a844d1c3d79f764278818bdeea6cbf1afe80aaf2dcee578e
Instruction ID: 46d32faaaef7be0b0dac0a2bb533b97a3addcaa7eae54bc26b9d1aa45a6fdbb5
Opcode Fuzzy Hash: b8c1732006bdadc0a844d1c3d79f764278818bdeea6cbf1afe80aaf2dcee578e
Instruction Fuzzy Hash: 80321522D79F054DD7239634D832339A25DAFB73D8F15D737E81AB5AA6EB28C4834200

Function 00A0267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad508f1aeab22627b9437facd3ae4f7c8b5b67c65fc3ea8ee331a8b8eec673bc
Instruction ID: 50bffac3e9c8851c96cca7a497799475f18716f8a4744894cf610404b5e1cec7
Opcode Fuzzy Hash: ad508f1aeab22627b9437facd3ae4f7c8b5b67c65fc3ea8ee331a8b8eec673bc
Instruction Fuzzy Hash: 52B12320E2AF414DD32396398835336B76CAFBB2C5F51D71BFC2674E62EB6285834641

Function 00A38B13 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00A38B25

Part of subcall function 009F543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00A391F8,00000000,?,?,?,?,00A393A9,00000000,?), ref: 009F5443
Part of subcall function 009F543A: __aulldiv.LIBCMT ref: 009F5463

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 227c7c46bc27532a5d956697535b2ae2527a83f1913e75d5765b4601e9b7c3c8
Instruction ID: e5865f917af33de198a84e124cca1be8a060a7cab92a4feb6eba18c8b8caefa1
Opcode Fuzzy Hash: 227c7c46bc27532a5d956697535b2ae2527a83f1913e75d5765b4601e9b7c3c8
Instruction Fuzzy Hash: 2021DF72635610CBC729CF29D841A56B3E1EBA4321F298E6DE1E5CB2D0CE74BD05CB94

Function 00A441FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00A44218

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: f6f0d79520857ebe7085813ba60ebb39f8e82e50fee11b76ea4b4508a54b8478
Instruction ID: f0b6220835242b05a2b5ac62be3250a3ab8b188f48e8a38499e7968d26b268a6
Opcode Fuzzy Hash: f6f0d79520857ebe7085813ba60ebb39f8e82e50fee11b76ea4b4508a54b8478
Instruction Fuzzy Hash: D3E01A36290214AFC710EF69D844B9AB7E8AF98761F008026F849C7352DAB0A8418BA0

Function 00A34EF5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00A34F18

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 6ac57284be0362f80dfbfb9b3a315b9e1d9ce89a01ddcb48dc9cc551123b4785
Instruction ID: 66d153fff204ab1938c6c8af9b069a93cf2ed0a14a0378b11843cb2492c74e6d
Opcode Fuzzy Hash: 6ac57284be0362f80dfbfb9b3a315b9e1d9ce89a01ddcb48dc9cc551123b4785
Instruction Fuzzy Hash: 37D05EB01642053DFC184B20AC0FF774508F348F82F9C49893201854C1A8E57C00E034

Function 00A28C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00A288D1), ref: 00A28CB3

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 80577bfc43f58b9a8351401327a6e7a2ce9284cc09351f5ab1c717410525365c
Instruction ID: 80d80b6d921834854b376627c644e206baf167a4a9726a6a063ebe5af6ce1018
Opcode Fuzzy Hash: 80577bfc43f58b9a8351401327a6e7a2ce9284cc09351f5ab1c717410525365c
Instruction Fuzzy Hash: CDD05E3226060EAFEF018EA4DC01EAE3B69EB04B01F408111FE15C50A1C775D835AB60

Function 00A12230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00A12242

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1ebaa9d2e20517909a52f99df97c4f66e740a7a7660cbb9cc100226e6b7c9785
Instruction ID: 50f40c687a90f616a48de2943d82559430a8222c247f080dff21971077486190
Opcode Fuzzy Hash: 1ebaa9d2e20517909a52f99df97c4f66e740a7a7660cbb9cc100226e6b7c9785
Instruction Fuzzy Hash: 1DC04CF1805109DBDB05DB90D988DEE77BCBB04315F144055A101F2140E7749B448A71

Function 009FA364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 009FA36A

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7cc2714722399e8c8af2f30985544aa54952d81a449c44c67a1f2cfc698cd2a4
Instruction ID: f22764e2980143e8cf1930cd422fdda682ce561c892da71016f3c5325d7a70c3
Opcode Fuzzy Hash: 7cc2714722399e8c8af2f30985544aa54952d81a449c44c67a1f2cfc698cd2a4
Instruction Fuzzy Hash: 29A0113000020CAB8A002F82EC08888BFACEA002A2B008020F80C880328B32A8228A80

Function 009E8A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ed12308d5b723b19aba8ee3992009e8d24fc6c456eebdcfb7db6ec418776da
Instruction ID: 66edef2acf60f0b9bd91bafdfda1dd47854d50a5d48d5fa088d5927946a86d17
Opcode Fuzzy Hash: b7ed12308d5b723b19aba8ee3992009e8d24fc6c456eebdcfb7db6ec418776da
Instruction Fuzzy Hash: E7222B309055A6CBDF2ACBAAD49467F77B5FB02300F39447AD88A9B191DB34DD81CB60

Function 009F2405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: af93518b1083117c9d47761b18a1f544df665da70cc07a70ee130e7abb99a96c
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: DFC184322051974ADF2D473AD43423EBAE59EA27B131A0B5EE5B3CB5D4EF20D624D720

Function 009F283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 929930da980a5139197881cd0452b2453c59846b0c4818a4d9ceac0a76502526
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 4BC1B53220519749DF2D473AD43413EBBE59BA27B131A0B6DE9B2DB5C4EF20D624E720

Function 009F1BB8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: d2bd532dfec41aba44702cee1e47725bbfd1a6b0a915174a1eac7c8eb11132ac
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: C3C1D53221919789DF2D463AC43403EBBE59EA27B131A0B6DE5B3CB5C4EF20D624D760

Function 00A47B1B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00A47B70
DeleteObject.GDI32(00000000), ref: 00A47B82
DestroyWindow.USER32 ref: 00A47B90
GetDesktopWindow.USER32 ref: 00A47BAA
GetWindowRect.USER32(00000000), ref: 00A47BB1
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00A47CF2
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00A47D02
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A47D4A
GetClientRect.USER32(00000000,?), ref: 00A47D56
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00A47D90
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A47DB2
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A47DC5
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A47DD0
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A47DD9
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A47DE8
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A47DF1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A47DF8
GlobalFree.KERNEL32(00000000), ref: 00A47E03
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A47E15
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00A62CAC,00000000), ref: 00A47E2B
GlobalFree.KERNEL32(00000000), ref: 00A47E3B
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00A47E61
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00A47E80
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A47EA2
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A4808F

Strings

AutoIt v3, xrefs: 00A47D42
DISPLAY, xrefs: 00A47EF2
, xrefs: 00A48015
static, xrefs: 00A47D8A, 00A47EE1

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 2b0f15cf53c5233ea769c59554b1deb7612dc3ce2d89f10a379303ae6fa952c4
Instruction ID: c4e7af4cc68f6e4279e48911830462dd5e1ad952f395ab15df042ec2600197b1
Opcode Fuzzy Hash: 2b0f15cf53c5233ea769c59554b1deb7612dc3ce2d89f10a379303ae6fa952c4
Instruction Fuzzy Hash: E6028F75A00205EFDB14DFA8DC89EAE7BB9FF88311F148159F915AB2A1CB709D01CB60

Function 00A537F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00A5F910), ref: 00A538AF
IsWindowVisible.USER32(?), ref: 00A538D3

Strings

EDITPASTE, xrefs: 00A53BE7
CURRENTTAB, xrefs: 00A53945
FINDSTRING, xrefs: 00A539FE
ADDSTRING, xrefs: 00A5399E
GETLINE, xrefs: 00A53C23
ISCHECKED, xrefs: 00A53AC1
SENDCOMMANDID, xrefs: 00A53C62
SHOWDROPDOWN, xrefs: 00A53968
GETCURRENTLINE, xrefs: 00A53B75
GETCURRENTSELECTION, xrefs: 00A53A6B
DELSTRING, xrefs: 00A539D1
GETLINECOUNT, xrefs: 00A53B4E
TABRIGHT, xrefs: 00A53925
CHECK, xrefs: 00A53AF5
SETCURRENTSELECTION, xrefs: 00A53A3E
ISVISIBLE, xrefs: 00A538BF
GETCURRENTCOL, xrefs: 00A53BB0
UNCHECK, xrefs: 00A53B0B
TABLEFT, xrefs: 00A5390F
HIDEDROPDOWN, xrefs: 00A53988
GETSELECTED, xrefs: 00A53B2B
SELECTSTRING, xrefs: 00A53A8E
ISENABLED, xrefs: 00A538F3

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 318b7ee1d542fa50712af5c2a7f5a95c17acfb789e6850ae97cbc032e58af562
Instruction ID: a4893647a525ff98a01d0ebe9a406756f6e18699f19f882c8c8f864b8a895655
Opcode Fuzzy Hash: 318b7ee1d542fa50712af5c2a7f5a95c17acfb789e6850ae97cbc032e58af562
Instruction Fuzzy Hash: D8D15A312143199BCB24EF24C551A6AB7A5BFD5385F108469BC865B3A3CB31EE0ECB91

Function 00A5A849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00A5A89F
GetSysColorBrush.USER32(0000000F), ref: 00A5A8D0
GetSysColor.USER32(0000000F), ref: 00A5A8DC
SetBkColor.GDI32(?,000000FF), ref: 00A5A8F6
SelectObject.GDI32(?,?), ref: 00A5A905
InflateRect.USER32(?,000000FF,000000FF), ref: 00A5A930
GetSysColor.USER32(00000010), ref: 00A5A938
CreateSolidBrush.GDI32(00000000), ref: 00A5A93F
FrameRect.USER32(?,?,00000000), ref: 00A5A94E
DeleteObject.GDI32(00000000), ref: 00A5A955
InflateRect.USER32(?,000000FE,000000FE), ref: 00A5A9A0
FillRect.USER32(?,?,?), ref: 00A5A9D2
GetWindowLongW.USER32(?,000000F0), ref: 00A5A9FD

Part of subcall function 00A5AB60: GetSysColor.USER32(00000012), ref: 00A5AB99
Part of subcall function 00A5AB60: SetTextColor.GDI32(?,?), ref: 00A5AB9D
Part of subcall function 00A5AB60: GetSysColorBrush.USER32(0000000F), ref: 00A5ABB3
Part of subcall function 00A5AB60: GetSysColor.USER32(0000000F), ref: 00A5ABBE
Part of subcall function 00A5AB60: GetSysColor.USER32(00000011), ref: 00A5ABDB
Part of subcall function 00A5AB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00A5ABE9
Part of subcall function 00A5AB60: SelectObject.GDI32(?,00000000), ref: 00A5ABFA
Part of subcall function 00A5AB60: SetBkColor.GDI32(?,00000000), ref: 00A5AC03
Part of subcall function 00A5AB60: SelectObject.GDI32(?,?), ref: 00A5AC10
Part of subcall function 00A5AB60: InflateRect.USER32(?,000000FF,000000FF), ref: 00A5AC2F
Part of subcall function 00A5AB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00A5AC46
Part of subcall function 00A5AB60: GetWindowLongW.USER32(00000000,000000F0), ref: 00A5AC5B

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 7ca6a73685a93fefeabac62ce04faee504255ee9d68c10814d029bfa0a3027cc
Instruction ID: 69ded61903a7d5bd97826b5a17626929d654c08dac726873d0c83801b251dae3
Opcode Fuzzy Hash: 7ca6a73685a93fefeabac62ce04faee504255ee9d68c10814d029bfa0a3027cc
Instruction Fuzzy Hash: B1A17F72108301EFD711DFA4DC08A6B7BA9FF88322F104B29FA62961E1D771D945CB52

Function 009D2C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 009D2CA2
DeleteObject.GDI32(00000000), ref: 009D2CE8
DeleteObject.GDI32(00000000), ref: 009D2CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 009D2CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 009D2D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00A0C68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00A0C6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00A0CAED

Part of subcall function 009D1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,009D2036,?,00000000,?,?,?,?,009D16CB,00000000,?), ref: 009D1B9A

SendMessageW.USER32(?,00001053), ref: 00A0CB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00A0CB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00A0CB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00A0CB62

Strings

0, xrefs: 00A0C981

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 87459dd8a45ad7b28ac3c082ccecacfb9b56d5fba47219872b527bce1cbd1a26
Instruction ID: 20a821def873aa01955808be3f039b7e0637e1e328d349f0ea82f480f7c393d6
Opcode Fuzzy Hash: 87459dd8a45ad7b28ac3c082ccecacfb9b56d5fba47219872b527bce1cbd1a26
Instruction Fuzzy Hash: AB12BF30600205EFDB21CF24D884BA9B7E5FF55361F5486AAF895DB2A2C731EC42CB91

Function 00A477BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00A477F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00A478B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00A478EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00A47900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00A47946
GetClientRect.USER32(00000000,?), ref: 00A47952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00A47996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00A479A5
GetStockObject.GDI32(00000011), ref: 00A479B5
SelectObject.GDI32(00000000,00000000), ref: 00A479B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00A479C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A479D2
DeleteDC.GDI32(00000000), ref: 00A479DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00A47A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 00A47A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00A47A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00A47A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 00A47A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00A47AAE
GetStockObject.GDI32(00000011), ref: 00A47AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00A47AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00A47ACE

Strings

AutoIt v3, xrefs: 00A4793E
DISPLAY, xrefs: 00A4799B
msctls_progress32, xrefs: 00A47A4F
static, xrefs: 00A47990, 00A47AA8

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 86c521ddfded773848fc387884a92fc458b023fbcef3abac69c22debc1065c17
Instruction ID: 858fe6f857c2ff3eb3f27c31c49d4b0fd47c6c345a506143f5fa5b78667413b8
Opcode Fuzzy Hash: 86c521ddfded773848fc387884a92fc458b023fbcef3abac69c22debc1065c17
Instruction Fuzzy Hash: 33A15C71A40215BFEB14DBA8DD4AFAE7BA9FF48711F008115FA15A72E0DB70AD01CB60

Function 00A3AF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A3AF89
GetDriveTypeW.KERNEL32(?,00A5FAC0,?,\\.\,00A5F910), ref: 00A3B066
SetErrorMode.KERNEL32(00000000,00A5FAC0,?,\\.\,00A5F910), ref: 00A3B1C4

Strings

SATA, xrefs: 00A3B177
RAID, xrefs: 00A3B162
1394, xrefs: 00A3B146
PhysicalDrive, xrefs: 00A3B012
Virtual, xrefs: 00A3B18C
RAMDisk, xrefs: 00A3B090
ATA, xrefs: 00A3B13F
iSCSI, xrefs: 00A3B169
SAS, xrefs: 00A3B170
FileBackedVirtual, xrefs: 00A3B193
Fixed, xrefs: 00A3B0AE
ATAPI, xrefs: 00A3B138
SSD, xrefs: 00A3B0F1
\\.\, xrefs: 00A3AFDB
MMC, xrefs: 00A3B185
CDROM, xrefs: 00A3B09A
SCSI, xrefs: 00A3B131
SSA, xrefs: 00A3B14D
Unknown, xrefs: 00A3B086, 00A3B12A
USB, xrefs: 00A3B15B
Fibre, xrefs: 00A3B154
Network, xrefs: 00A3B0A4
Removable, xrefs: 00A3B0B8

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 8e8237fcb8635c0d78eab93f968c40dabd752b84b1ce207b450de83bcfaba66f
Instruction ID: 17cbb89e05a3a4415f8f72c3b35ce94c1d73c8a46c82f9458ae2ac92f9c2f0ab
Opcode Fuzzy Hash: 8e8237fcb8635c0d78eab93f968c40dabd752b84b1ce207b450de83bcfaba66f
Instruction Fuzzy Hash: 8051C3306A4305FFDB04EB50C99297D73B2BB65341F208617F60AE7290D7B5AD41EBA2

Function 009D6A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 009D6A91
__wcsnicmp.LIBCMT ref: 009D6AA9
__wcsnicmp.LIBCMT ref: 009D6AC1
__wcsnicmp.LIBCMT ref: 009D6AD9
__wcsnicmp.LIBCMT ref: 009D6AF1
__wcsnicmp.LIBCMT ref: 009D6B09
__wcsnicmp.LIBCMT ref: 009D6B21
__wcsnicmp.LIBCMT ref: 009D6B35
__wcsnicmp.LIBCMT ref: 009D6B76
__wcsnicmp.LIBCMT ref: 009D6B8A
__wcsnicmp.LIBCMT ref: 009D6B9E
__wcsnicmp.LIBCMT ref: 009D6BB2

Strings

Bad directive syntax error, xrefs: 00A0E743
Unterminated group of comments, xrefs: 00A0E82C
#requireadmin, xrefs: 009D6ABB
#include, xrefs: 009D6B03
#pragma compile, xrefs: 009D6A8B
#comments-start, xrefs: 009D6B1B, 009D6B70
#comments-end, xrefs: 009D6B98
Cannot parse #include, xrefs: 00A0E819
#include-once, xrefs: 009D6AEB
#OnAutoItStartRegister, xrefs: 009D6AD3
#cs, xrefs: 009D6B2F, 009D6B84
#notrayicon, xrefs: 009D6AA3
#ce, xrefs: 009D6BAC

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 0a275bd8f54ad619eb3f751f7a94249a2aadc631bbc4eea7eae1246010d99a1b
Instruction ID: b14fea56b57b6b5973cb1720e25a02e9c81ac2d2cb6f5d8ba293c14d56db72a9
Opcode Fuzzy Hash: 0a275bd8f54ad619eb3f751f7a94249a2aadc631bbc4eea7eae1246010d99a1b
Instruction Fuzzy Hash: 42811C70684609BADB20EF61DD82FBE7768BF50700F04C426FD46A62C2EB74EA45D791

Function 00A5AB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00A5AB99
SetTextColor.GDI32(?,?), ref: 00A5AB9D
GetSysColorBrush.USER32(0000000F), ref: 00A5ABB3
GetSysColor.USER32(0000000F), ref: 00A5ABBE
CreateSolidBrush.GDI32(?), ref: 00A5ABC3
GetSysColor.USER32(00000011), ref: 00A5ABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00A5ABE9
SelectObject.GDI32(?,00000000), ref: 00A5ABFA
SetBkColor.GDI32(?,00000000), ref: 00A5AC03
SelectObject.GDI32(?,?), ref: 00A5AC10
InflateRect.USER32(?,000000FF,000000FF), ref: 00A5AC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00A5AC46
GetWindowLongW.USER32(00000000,000000F0), ref: 00A5AC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00A5ACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00A5ACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 00A5ACEC
DrawFocusRect.USER32(?,?), ref: 00A5ACF7
GetSysColor.USER32(00000011), ref: 00A5AD05
SetTextColor.GDI32(?,00000000), ref: 00A5AD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00A5AD21
SelectObject.GDI32(?,00A5A869), ref: 00A5AD38
DeleteObject.GDI32(?), ref: 00A5AD43
SelectObject.GDI32(?,?), ref: 00A5AD49
DeleteObject.GDI32(?), ref: 00A5AD4E
SetTextColor.GDI32(?,?), ref: 00A5AD54
SetBkColor.GDI32(?,?), ref: 00A5AD5E

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: baa9e010dc32b8631691dce5e08d029424553e8afe1edc4834af9210515c8111
Instruction ID: bf5378e43ed7f750f2c89bd26d8922b3354cc39f7ed5fe89ce65389ce9b273e0
Opcode Fuzzy Hash: baa9e010dc32b8631691dce5e08d029424553e8afe1edc4834af9210515c8111
Instruction Fuzzy Hash: B0614C71900218AFDF11DFA4DC48AAE7B79FB08322F118225FA15AB2A1D7719D41DB90

Function 00A58C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00A58D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A58D45
CharNextW.USER32(0000014E), ref: 00A58D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00A58DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00A58DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A58DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00A58DF9
SetWindowTextW.USER32(?,0000014E), ref: 00A58E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00A58E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 00A58E8C
_memset.LIBCMT ref: 00A58EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00A58EFA
_memset.LIBCMT ref: 00A58F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00A58F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 00A58FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 00A59088
InvalidateRect.USER32(?,00000000,00000001), ref: 00A590AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00A590F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00A59121
DrawMenuBar.USER32(?), ref: 00A59130
SetWindowTextW.USER32(?,0000014E), ref: 00A59158

Strings

0, xrefs: 00A590C2

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 11e1630ede3012f497da4cf10edb2fea72ee40afaa7be5a72408b4ef4e89599e
Instruction ID: caf9a82c8debefe2b8477062f63e2d779c3724456d883db6ff92f607f2ec5d2d
Opcode Fuzzy Hash: 11e1630ede3012f497da4cf10edb2fea72ee40afaa7be5a72408b4ef4e89599e
Instruction Fuzzy Hash: 21E16E71901219AEDF20DFA0CC84AEF7BB9FF05711F10815AFD15AA291DB748A89DF60

Function 00A54B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00A54C51
GetDesktopWindow.USER32 ref: 00A54C66
GetWindowRect.USER32(00000000), ref: 00A54C6D
GetWindowLongW.USER32(?,000000F0), ref: 00A54CCF
DestroyWindow.USER32(?), ref: 00A54CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00A54D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A54D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00A54D68
SendMessageW.USER32(?,00000421,?,?), ref: 00A54D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00A54D90
IsWindowVisible.USER32(?), ref: 00A54DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00A54DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00A54DDF
GetWindowRect.USER32(?,?), ref: 00A54DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 00A54E1D
GetMonitorInfoW.USER32(00000000,?), ref: 00A54E37
CopyRect.USER32(?,?), ref: 00A54E4E
SendMessageW.USER32(?,00000412,00000000), ref: 00A54EB9

Strings

tooltips_class32, xrefs: 00A54D1D
0, xrefs: 00A54BFC
(, xrefs: 00A54E2A

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 40822dc2d1a7bf87729ba221e6933565764f4321e2353cf7a7dc26ddae3a226e
Instruction ID: df542ada836db58712495b1bca04472c289f8b40d859c1aeeeb4d0aaa368336d
Opcode Fuzzy Hash: 40822dc2d1a7bf87729ba221e6933565764f4321e2353cf7a7dc26ddae3a226e
Instruction Fuzzy Hash: B6B19D71608340AFDB04DF65C849B6ABBE4FF88315F00891DF9999B2A1D771EC49CB91

Function 009D27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 009D28BC
GetSystemMetrics.USER32(00000007), ref: 009D28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 009D28EF
GetSystemMetrics.USER32(00000008), ref: 009D28F7
GetSystemMetrics.USER32(00000004), ref: 009D291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 009D2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 009D2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 009D297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 009D2990
GetClientRect.USER32(00000000,000000FF), ref: 009D29AE
GetStockObject.GDI32(00000011), ref: 009D29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 009D29D5

Part of subcall function 009D2344: GetCursorPos.USER32(?), ref: 009D2357
Part of subcall function 009D2344: ScreenToClient.USER32(00A967B0,?), ref: 009D2374
Part of subcall function 009D2344: GetAsyncKeyState.USER32(00000001), ref: 009D2399
Part of subcall function 009D2344: GetAsyncKeyState.USER32(00000002), ref: 009D23A7

SetTimer.USER32(00000000,00000000,00000028,009D1256), ref: 009D29FC

Strings

AutoIt v3 GUI, xrefs: 009D2974

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 6911e2378e3e024240ed8a1bf671a5d865174be27eab6d6cd4abd6b7dffec502
Instruction ID: 91b8d1cbc050e5077bfd2c36865a3a1981aa954b374d248017cd2d90cdc722c9
Opcode Fuzzy Hash: 6911e2378e3e024240ed8a1bf671a5d865174be27eab6d6cd4abd6b7dffec502
Instruction Fuzzy Hash: 20B17C71A4020AEFDB14DFA8DC45BAE7BB4FF58315F10822AFA15A72D0DB74A841CB51

Function 00A54069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A540F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00A541B6

Strings

SELECTINVERT, xrefs: 00A54286
SELECT, xrefs: 00A54250
GETTEXT, xrefs: 00A5415F
GETSUBITEMCOUNT, xrefs: 00A54141
FINDITEM, xrefs: 00A54329
VIEWCHANGE, xrefs: 00A54375
ISSELECTED, xrefs: 00A541C1
SELECTCLEAR, xrefs: 00A54235
GETSELECTED, xrefs: 00A542E4
GETSELECTEDCOUNT, xrefs: 00A54199
SELECTALL, xrefs: 00A5421D
GETITEMCOUNT, xrefs: 00A54128
DESELECT, xrefs: 00A542A4

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: aaca96e628a636ce8840100062580e857a9a7b24ac2cceff9674b5ef784fa5d4
Instruction ID: 2b4d3ca2eac2f29edcb84903506950af76ec8ca9bb3482ab26a879e25eff15da
Opcode Fuzzy Hash: aaca96e628a636ce8840100062580e857a9a7b24ac2cceff9674b5ef784fa5d4
Instruction Fuzzy Hash: 39A1AE302143159FCB14FF24C951B6AB3A5BF89319F108969BC9A9B7E2DB30EC49CB51

Function 00A452F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00A45309
LoadCursorW.USER32(00000000,00007F8A), ref: 00A45314
LoadCursorW.USER32(00000000,00007F00), ref: 00A4531F
LoadCursorW.USER32(00000000,00007F03), ref: 00A4532A
LoadCursorW.USER32(00000000,00007F8B), ref: 00A45335
LoadCursorW.USER32(00000000,00007F01), ref: 00A45340
LoadCursorW.USER32(00000000,00007F81), ref: 00A4534B
LoadCursorW.USER32(00000000,00007F88), ref: 00A45356
LoadCursorW.USER32(00000000,00007F80), ref: 00A45361
LoadCursorW.USER32(00000000,00007F86), ref: 00A4536C
LoadCursorW.USER32(00000000,00007F83), ref: 00A45377
LoadCursorW.USER32(00000000,00007F85), ref: 00A45382
LoadCursorW.USER32(00000000,00007F82), ref: 00A4538D
LoadCursorW.USER32(00000000,00007F84), ref: 00A45398
LoadCursorW.USER32(00000000,00007F04), ref: 00A453A3
LoadCursorW.USER32(00000000,00007F02), ref: 00A453AE
GetCursorInfo.USER32(?), ref: 00A453BE
GetLastError.KERNEL32(00000001,00000000), ref: 00A453E9

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 6ab18803ed8d07add7c925bc175658bc3e3d5eea60ba00a71729b31ec96b5f4b
Instruction ID: 9ce6120ed70254228289b5623022c74c92c221424a36c5773980ceedf318467d
Opcode Fuzzy Hash: 6ab18803ed8d07add7c925bc175658bc3e3d5eea60ba00a71729b31ec96b5f4b
Instruction Fuzzy Hash: 3F415470E443196BDB109FBA8C4996FFFF8EF91B50B10452FF509EB291DAB894018E61

Function 00A2AA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00A2AAA5
__swprintf.LIBCMT ref: 00A2AB46
_wcscmp.LIBCMT ref: 00A2AB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00A2ABAE
_wcscmp.LIBCMT ref: 00A2ABEA
GetClassNameW.USER32(?,?,00000400), ref: 00A2AC21
GetDlgCtrlID.USER32(?), ref: 00A2AC73
GetWindowRect.USER32(?,?), ref: 00A2ACA9
GetParent.USER32(?), ref: 00A2ACC7
ScreenToClient.USER32(00000000), ref: 00A2ACCE
GetClassNameW.USER32(?,?,00000100), ref: 00A2AD48
_wcscmp.LIBCMT ref: 00A2AD5C
GetWindowTextW.USER32(?,?,00000400), ref: 00A2AD82
_wcscmp.LIBCMT ref: 00A2AD96

Part of subcall function 009F386C: _iswctype.LIBCMT ref: 009F3874

Strings

%s%u, xrefs: 00A2AB40

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: df9503bb26494fa2fdb07919b11bfca5bd9e9f3914d9cdad7017e4e02dfc9d20
Instruction ID: 91bb5b7096cc287a7a1b83d35154709c5e6ef4a26169fc0fd69a73e1c20e6292
Opcode Fuzzy Hash: df9503bb26494fa2fdb07919b11bfca5bd9e9f3914d9cdad7017e4e02dfc9d20
Instruction Fuzzy Hash: 3FA11F31204726AFDB18DF68D884BAAF7E8FF54355F108639F999C2190DB30E945CB92

Function 00A2B397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00A2B3DB
_wcscmp.LIBCMT ref: 00A2B3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 00A2B414
CharUpperBuffW.USER32(?,00000000), ref: 00A2B431
_wcscmp.LIBCMT ref: 00A2B44F
_wcsstr.LIBCMT ref: 00A2B460
GetClassNameW.USER32(00000018,?,00000400), ref: 00A2B498
_wcscmp.LIBCMT ref: 00A2B4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 00A2B4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 00A2B518
_wcscmp.LIBCMT ref: 00A2B528
GetClassNameW.USER32(00000010,?,00000400), ref: 00A2B550
GetWindowRect.USER32(00000004,?), ref: 00A2B5B9

Strings

ThumbnailClass, xrefs: 00A2B4A3, 00A2B523
@, xrefs: 00A2B3BC

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 1784ccdcc131289862aaa3f775c183dd783dd3e957bcc89ee28cb4ff3af1c42f
Instruction ID: 40641c76b7f8181926bc86f940c56f6a2ca06c15bfa5b60d5e79ae4fcc645550
Opcode Fuzzy Hash: 1784ccdcc131289862aaa3f775c183dd783dd3e957bcc89ee28cb4ff3af1c42f
Instruction Fuzzy Hash: 91818C710183199FDB04DF18E885FAA7BE8EF84314F188579FD858A0A2DB34DD45CB61

Function 00A2B1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00A2B23F

Strings

[HANDLE:, xrefs: 00A2B24B
[LAST, xrefs: 00A2B2EC
REGEXP=, xrefs: 00A2B254
HANDLE=, xrefs: 00A2B238
LAST, xrefs: 00A2B204
ACTIVE, xrefs: 00A2B21A
[CLASS:, xrefs: 00A2B28F
ALL, xrefs: 00A2B2D3
[ACTIVE, xrefs: 00A2B22C
CLASSNAME=, xrefs: 00A2B27C
[REGEXPTITLE:, xrefs: 00A2B267
[ALL, xrefs: 00A2B2E5

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 6cbe1712fa01805c4ea18708480bd1563b2dd6c492c7589f1ee13781e693f4f0
Instruction ID: 3ab123be663e8d57df6e2695cfe85e6fc962a5d7d2cd3a9b2bf86a43320c4d58
Opcode Fuzzy Hash: 6cbe1712fa01805c4ea18708480bd1563b2dd6c492c7589f1ee13781e693f4f0
Instruction Fuzzy Hash: 23318D30A58319A6DB14FAA4DD43BFEB7A4AF10750F644826B442711D2EF616E04C761

Function 00A2C4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00A2C4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00A2C4E6
SetWindowTextW.USER32(?,?), ref: 00A2C4FD
GetDlgItem.USER32(?,000003EA), ref: 00A2C512
SetWindowTextW.USER32(00000000,?), ref: 00A2C518
GetDlgItem.USER32(?,000003E9), ref: 00A2C528
SetWindowTextW.USER32(00000000,?), ref: 00A2C52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00A2C54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00A2C569
GetWindowRect.USER32(?,?), ref: 00A2C572
SetWindowTextW.USER32(?,?), ref: 00A2C5DD
GetDesktopWindow.USER32 ref: 00A2C5E3
GetWindowRect.USER32(00000000), ref: 00A2C5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00A2C636
GetClientRect.USER32(?,?), ref: 00A2C643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00A2C668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00A2C693

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: cc07e3036ceb222962f7300b2f3ea994b270b9f7050538e27a57b39d3910d44b
Instruction ID: 852b8e10f654623059f5c05c46ef09f47a36ae02879379b31e6e16532cde6dff
Opcode Fuzzy Hash: cc07e3036ceb222962f7300b2f3ea994b270b9f7050538e27a57b39d3910d44b
Instruction Fuzzy Hash: 2B516B70900719AFDB20DFA8EE89B6FBBF5FF04715F004928E686A25A0D775E905CB50

Function 00A5A428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A5A4C8
DestroyWindow.USER32(?,?), ref: 00A5A542

Part of subcall function 009D7D2C: _memmove.LIBCMT ref: 009D7D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00A5A5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00A5A5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A5A5F1
DestroyWindow.USER32(00000000), ref: 00A5A613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,009D0000,00000000), ref: 00A5A64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A5A663
GetDesktopWindow.USER32 ref: 00A5A67C
GetWindowRect.USER32(00000000), ref: 00A5A683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00A5A69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00A5A6B3

Part of subcall function 009D25DB: GetWindowLongW.USER32(?,000000EB), ref: 009D25EC

Strings

tooltips_class32, xrefs: 00A5A5B5, 00A5A643
0, xrefs: 00A5A4DE

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 94e8a54e64e05dd6d2c1bf8dbb528e0cfc58b2e8db7653e0eacb2e9b67e14f34
Instruction ID: b3e0e68a01e0be3a2c508f62ac294ad76a54b5f2922af280c6d2cb1d0d0e8df5
Opcode Fuzzy Hash: 94e8a54e64e05dd6d2c1bf8dbb528e0cfc58b2e8db7653e0eacb2e9b67e14f34
Instruction Fuzzy Hash: 5B71AF75240345AFD720DF68DC49F667BE6FB98305F08462DF985872A0DB70E90ACB52

Function 00A5C8EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 009D2612: GetWindowLongW.USER32(?,000000EB), ref: 009D2623

DragQueryPoint.SHELL32(?,?), ref: 00A5C917

Part of subcall function 00A5ADF1: ClientToScreen.USER32(?,?), ref: 00A5AE1A
Part of subcall function 00A5ADF1: GetWindowRect.USER32(?,?), ref: 00A5AE90
Part of subcall function 00A5ADF1: PtInRect.USER32(?,?,00A5C304), ref: 00A5AEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 00A5C980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00A5C98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00A5C9AE
_wcscat.LIBCMT ref: 00A5C9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00A5C9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 00A5CA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 00A5CA25
SendMessageW.USER32(?,000000B1,?,?), ref: 00A5CA47
DragFinish.SHELL32(?), ref: 00A5CA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00A5CB41

Strings

@GUI_DRAGID, xrefs: 00A5CAB9
@GUI_DROPID, xrefs: 00A5CA6E
@GUI_DRAGFILE, xrefs: 00A5CAF0

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 8794f61dd645657d8ff9edba47e71ecb6b2d13434746e4e40435b9be3e9d542d
Instruction ID: 692b1b83900f3c1902369587fdf3b7c98b04eab9a239e05f813eba6ed60bb20d
Opcode Fuzzy Hash: 8794f61dd645657d8ff9edba47e71ecb6b2d13434746e4e40435b9be3e9d542d
Instruction Fuzzy Hash: CE613771108301AFC711EFA4D885E9BBBE8FFD8751F00492EF591962A1DB709A49CB52

Function 00A54619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A546AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00A546F6

Strings

GETTOTALCOUNT, xrefs: 00A546DD
CHECK, xrefs: 00A54716
SELECT, xrefs: 00A548A7
ISCHECKED, xrefs: 00A54879
UNCHECK, xrefs: 00A548D2
GETTEXT, xrefs: 00A54849
COLLAPSE, xrefs: 00A5473C
GETSELECTED, xrefs: 00A54806
EXISTS, xrefs: 00A5475F
GETITEMCOUNT, xrefs: 00A547D8
EXPAND, xrefs: 00A547A8

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 17ef0253938dd2929d866a18c914d73ac423214107629c5ceaa5974db7c75e47
Instruction ID: 9652d3f6cfc4dd1b1ff2e92433e0b470c79c2ccd4961e6eb5c2c0f309b7b7a9e
Opcode Fuzzy Hash: 17ef0253938dd2929d866a18c914d73ac423214107629c5ceaa5974db7c75e47
Instruction Fuzzy Hash: DE916A342047159FCB14EF24C451B6AB7A5BF99318F04886DBC965B7A3DB30ED4ACB81

Function 00A5BAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00A5BB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00A56D80,?), ref: 00A5BBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00A5BC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00A5BC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00A5BC7D
FreeLibrary.KERNEL32(?), ref: 00A5BC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00A5BC99
DestroyIcon.USER32(?), ref: 00A5BCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00A5BCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00A5BCD1

Part of subcall function 009F313D: __wcsicmp_l.LIBCMT ref: 009F31C6

Strings

.dll, xrefs: 00A5BB27
.icl, xrefs: 00A5BAE4
.exe, xrefs: 00A5BB04

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: a4b0bd29297b5f00ffbc73e185239578a7ba4f216d8b394d1fcb9374f3e12345
Instruction ID: ece6ebecfeeef6d9ede4f7028a702a006ef2cf5a0c280dcca87ab31ea1998a5e
Opcode Fuzzy Hash: a4b0bd29297b5f00ffbc73e185239578a7ba4f216d8b394d1fcb9374f3e12345
Instruction Fuzzy Hash: B561CFB1650619BEEB14DF64CC45BBA77A8FB08712F20411AFD15D61D0DBB4AA84CBB0

Function 00A3A5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 009D9997: __itow.LIBCMT ref: 009D99C2
Part of subcall function 009D9997: __swprintf.LIBCMT ref: 009D9A0C

CharLowerBuffW.USER32(?,?), ref: 00A3A636
GetDriveTypeW.KERNEL32 ref: 00A3A683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A3A6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A3A702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A3A730

Part of subcall function 009D7D2C: _memmove.LIBCMT ref: 009D7D66

Strings

close cd wait, xrefs: 00A3A71B
close, xrefs: 00A3A63C
closed, xrefs: 00A3A64A, 00A3A653
open , xrefs: 00A3A692
open, xrefs: 00A3A65D
wait, xrefs: 00A3A6ED
set cd door , xrefs: 00A3A6D1
type cdaudio alias cd wait, xrefs: 00A3A6AE

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 15585ba3d2b3ab8b4d52b77d52d8f2526a3cb17267e43709d6eb461e358108fd
Instruction ID: 4dd0bdb46eb3563aa5dddf8dcc22f43e4694d4755beabee187f03632cd5f0da3
Opcode Fuzzy Hash: 15585ba3d2b3ab8b4d52b77d52d8f2526a3cb17267e43709d6eb461e358108fd
Instruction Fuzzy Hash: D7514C711047159FC700EF24C991A6AB7F8FF94718F04896EF896973A1EB31AE06CB52

Function 00A3A45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00A3A47A
__swprintf.LIBCMT ref: 00A3A49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 00A3A4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00A3A4FE
_memset.LIBCMT ref: 00A3A51D
_wcsncpy.LIBCMT ref: 00A3A559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00A3A58E
CloseHandle.KERNEL32(00000000), ref: 00A3A599
RemoveDirectoryW.KERNEL32(?), ref: 00A3A5A2
CloseHandle.KERNEL32(00000000), ref: 00A3A5AC

Strings

\??\%s, xrefs: 00A3A496
:, xrefs: 00A3A4BD
\, xrefs: 00A3A4B2

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 16094f4b053771176bb6e8a2dee04ec28c642c2c9a70d786bb549678b2743721
Instruction ID: 751d31fe9aae4a49f5db4e5738bad9f810388559e8b168c4032041e032d3a230
Opcode Fuzzy Hash: 16094f4b053771176bb6e8a2dee04ec28c642c2c9a70d786bb549678b2743721
Instruction Fuzzy Hash: B8319EB6500219ABDB21DFA0DC49FEB77BCEF98701F1041B6FA08D6160EB7496458B25

Function 00A0AB1B Relevance: 22.7, APIs: 15, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 00A0AB7B
___wtomb_environ.LIBCMT ref: 00A0AB9D

Part of subcall function 009F8D68: __getptd_noexit.LIBCMT ref: 009F8D68

__malloc_crt.LIBCMT ref: 00A0ABC5
__malloc_crt.LIBCMT ref: 00A0ABE2
_free.LIBCMT ref: 00A0AC19
__recalloc_crt.LIBCMT ref: 00A0AC52
__recalloc_crt.LIBCMT ref: 00A0AC97
_strlen.LIBCMT ref: 00A0ACC3
__calloc_crt.LIBCMT ref: 00A0ACCD
_strlen.LIBCMT ref: 00A0ACDC
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 00A0AD0A
_free.LIBCMT ref: 00A0AD24
_free.LIBCMT ref: 00A0AD31
_free.LIBCMT ref: 00A0AD43
__invoke_watson.LIBCMT ref: 00A0AD5D

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: b23ff62fce0bbc725c79ac2f0ada3ae0c246e0fecd3a4a77edae33a7488dc4df
Instruction ID: 0e351ad76e3d360e285d3fb319f0fb4d31a7f1ec782defe1ef0f036ad5231005
Opcode Fuzzy Hash: b23ff62fce0bbc725c79ac2f0ada3ae0c246e0fecd3a4a77edae33a7488dc4df
Instruction Fuzzy Hash: EC61F47291030DAFEB209F64FC41B7A77A5EF66325F244216E9059B1D1DB74CC42C792

Function 00A3DB04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00A3DC7B
_wcscat.LIBCMT ref: 00A3DC93
_wcscat.LIBCMT ref: 00A3DCA5
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00A3DCBA
SetCurrentDirectoryW.KERNEL32(?), ref: 00A3DCCE
GetFileAttributesW.KERNEL32(?), ref: 00A3DCE6
SetFileAttributesW.KERNEL32(?,00000000), ref: 00A3DD00
SetCurrentDirectoryW.KERNEL32(?), ref: 00A3DD12

Strings

*.*, xrefs: 00A3DD51

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 5fce49e8737ef29ae55ec73994e7313203482d9d95287d7b6ac765bb4e792945
Instruction ID: 80f874e822be888a1481de7df8ab0f0f1ea2ddbe4262dd248b48e4be31aa0b57
Opcode Fuzzy Hash: 5fce49e8737ef29ae55ec73994e7313203482d9d95287d7b6ac765bb4e792945
Instruction Fuzzy Hash: DA818071514345DFCB64EF64D885AAAF7E8BF88350F19882EF889CB250E730E945CB52

Function 00A5C49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D2612: GetWindowLongW.USER32(?,000000EB), ref: 009D2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00A5C4EC
GetFocus.USER32 ref: 00A5C4FC
GetDlgCtrlID.USER32(00000000), ref: 00A5C507
_memset.LIBCMT ref: 00A5C632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00A5C65D
GetMenuItemCount.USER32(?), ref: 00A5C67D
GetMenuItemID.USER32(?,00000000), ref: 00A5C690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00A5C6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00A5C70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00A5C744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00A5C779

Strings

0, xrefs: 00A5C62A

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 4589b009eafdfcd6d9adfe670c997ad081bf9b3c3237b37c847935127432efae
Instruction ID: 650a0234fb6c1ee89a10574529f587d88f57b6ba75a40c9e648d4dc2b672da51
Opcode Fuzzy Hash: 4589b009eafdfcd6d9adfe670c997ad081bf9b3c3237b37c847935127432efae
Instruction Fuzzy Hash: C5817D70208311AFD710CF64C984A6BBBE8FF88366F10452EFD9597295D770D909CBA2

Function 00A283F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A2874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A28766
Part of subcall function 00A2874A: GetLastError.KERNEL32(?,00A2822A,?,?,?), ref: 00A28770
Part of subcall function 00A2874A: GetProcessHeap.KERNEL32(00000008,?,?,00A2822A,?,?,?), ref: 00A2877F
Part of subcall function 00A2874A: HeapAlloc.KERNEL32(00000000,?,00A2822A,?,?,?), ref: 00A28786
Part of subcall function 00A2874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A2879D

Part of subcall function 00A287E7: GetProcessHeap.KERNEL32(00000008,00A28240,00000000,00000000,?,00A28240,?), ref: 00A287F3
Part of subcall function 00A287E7: HeapAlloc.KERNEL32(00000000,?,00A28240,?), ref: 00A287FA
Part of subcall function 00A287E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00A28240,?), ref: 00A2880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00A28458
_memset.LIBCMT ref: 00A2846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00A2848C
GetLengthSid.ADVAPI32(?), ref: 00A2849D
GetAce.ADVAPI32(?,00000000,?), ref: 00A284DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00A284F6
GetLengthSid.ADVAPI32(?), ref: 00A28513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00A28522
HeapAlloc.KERNEL32(00000000), ref: 00A28529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00A2854A
CopySid.ADVAPI32(00000000), ref: 00A28551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00A28582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00A285A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00A285BC

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 674e91761aa9f3df51595d17d98e5a49b3221c79a0b57dbd6e75e37a2d54da41
Instruction ID: a1c9c339d691e7c3d8a9da79b7da287126350a5db2fb56f613f88a6eee949476
Opcode Fuzzy Hash: 674e91761aa9f3df51595d17d98e5a49b3221c79a0b57dbd6e75e37a2d54da41
Instruction Fuzzy Hash: 46615C71901219AFDF00DFA8ED45AEEBBB9FF04311F048169F915A7291EB399A05CF60

Function 00A4762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00A476A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00A476AE
CreateCompatibleDC.GDI32(?), ref: 00A476BA
SelectObject.GDI32(00000000,?), ref: 00A476C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00A4771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00A47757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00A4777B
SelectObject.GDI32(00000006,?), ref: 00A47783
DeleteObject.GDI32(?), ref: 00A4778C
DeleteDC.GDI32(00000006), ref: 00A47793
ReleaseDC.USER32(00000000,?), ref: 00A4779E

Strings

(, xrefs: 00A47723

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 2e52040d47cedb636028e61339010178686ebe4cc05ad9ce8cd64ed3e05057c6
Instruction ID: 97fbd3837495be658910acaabe0b2664a28a23e11c29374b071fd37cb9599aea
Opcode Fuzzy Hash: 2e52040d47cedb636028e61339010178686ebe4cc05ad9ce8cd64ed3e05057c6
Instruction Fuzzy Hash: 88513775904349EFCB15CFA8DC84EAEBBB9FF88310F148529F94A97250D731A8418B60

Function 00A3A0B5 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00A5FB78), ref: 00A3A0FC

Part of subcall function 009D7F41: _memmove.LIBCMT ref: 009D7F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 00A3A11E
__swprintf.LIBCMT ref: 00A3A177
__swprintf.LIBCMT ref: 00A3A190
_wprintf.LIBCMT ref: 00A3A246
_wprintf.LIBCMT ref: 00A3A264

Strings

Line %d (File "%s"):, xrefs: 00A3A171, 00A3A18A
"%s" (%d) : ==> %s:, xrefs: 00A3A25F
Error: , xrefs: 00A3A20E
"%s" (%d) : ==> %s:%s%s, xrefs: 00A3A241
^ ERROR, xrefs: 00A3A1E8

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: 08dba501b82c8e9b790f893b8368b1e8fad56f45b851ed329cf4d30f7551788a
Instruction ID: eac4fe4b91a963e885566033e60823cbbfcad5bb977b9b0dc938c629230ca026
Opcode Fuzzy Hash: 08dba501b82c8e9b790f893b8368b1e8fad56f45b851ed329cf4d30f7551788a
Instruction Fuzzy Hash: EA51897194021ABBCF15EBE0CE86FEEB778AF54300F108566B505722A1EB316F49CB61

Function 009D6BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 009F0B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,009D6C6C,?,00008000), ref: 009F0BB7

Part of subcall function 009D48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009D48A1,?,?,009D37C0,?), ref: 009D48CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 009D6D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 009D6E5A

Part of subcall function 009D59CD: _wcscpy.LIBCMT ref: 009D5A05

Part of subcall function 009F387D: _iswctype.LIBCMT ref: 009F3885

Strings

Unterminated string, xrefs: 00A0EC0D
Bad directive syntax error, xrefs: 00A0EBC6
>>>AUTOIT SCRIPT<<<, xrefs: 00A0E8BF
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00A0E84A
Error opening the file, xrefs: 00A0E866, 00A0E8E1
EA06, xrefs: 00A0E87B
AU3!, xrefs: 009D6CC1

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 0249b884895821dd3b0b4102ac298446379fec88c1e65016464bcba4c84f595f
Instruction ID: 827988a05f1c6cd260ed93d2dfdc86dc9fd75286f3919e7fca0bbac1998b7a20
Opcode Fuzzy Hash: 0249b884895821dd3b0b4102ac298446379fec88c1e65016464bcba4c84f595f
Instruction Fuzzy Hash: 810298311483459FC724EF24C891AAFBBE5AFD8354F048D2EF486972A1DB30D949DB52

Function 009D45DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009D45F9
GetMenuItemCount.USER32(00A96890), ref: 00A0D7CD
GetMenuItemCount.USER32(00A96890), ref: 00A0D87D
GetCursorPos.USER32(?), ref: 00A0D8C1
SetForegroundWindow.USER32(00000000), ref: 00A0D8CA
TrackPopupMenuEx.USER32(00A96890,00000000,?,00000000,00000000,00000000), ref: 00A0D8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00A0D8E9

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 905fd0931ffdfd671b5dd8012f7528c339c46714d30091406f9fd9eae1d4ed36
Instruction ID: 2221291d73e33f6f55392c6c5540453959946666dfb7cd53224830b51aab2b81
Opcode Fuzzy Hash: 905fd0931ffdfd671b5dd8012f7528c339c46714d30091406f9fd9eae1d4ed36
Instruction Fuzzy Hash: 97710871641209BFEB209FA4EC89FAABF64FF05364F244216F515AA1E1D7B1AC10DB90

Function 00A510A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A50038,?,?), ref: 00A510BC

Strings

HKCU, xrefs: 00A511AC
HKEY_USERS, xrefs: 00A511BD
HKCC, xrefs: 00A5118A
HKCR, xrefs: 00A51164
HKEY_CURRENT_USER, xrefs: 00A5119B
HKEY_LOCAL_MACHINE, xrefs: 00A51125
HKLM, xrefs: 00A5113A
HKU, xrefs: 00A511CE
HKEY_CLASSES_ROOT, xrefs: 00A5114F
HKEY_CURRENT_CONFIG, xrefs: 00A51179

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 0a809a93751511ba353b411c3aef7b670db903fdd3045527572f7a5c51b41adc
Instruction ID: 0025eb080a34651227515981d6514ca60b3c475a1a10805bb6911e6eb0ec1833
Opcode Fuzzy Hash: 0a809a93751511ba353b411c3aef7b670db903fdd3045527572f7a5c51b41adc
Instruction Fuzzy Hash: 0C41083015424E8BCF20EF90D895BFE3725BF96341F504669FD955B292EB30AD1ACBA0

Function 00A35569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 009D7D2C: _memmove.LIBCMT ref: 009D7D66

Part of subcall function 009D7A84: _memmove.LIBCMT ref: 009D7B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00A355D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00A355E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A355F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00A3560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00A3561C

Strings

play PlayMe wait, xrefs: 00A35606
open , xrefs: 00A35581
close PlayMe, xrefs: 00A355E3, 00A35610
status PlayMe mode, xrefs: 00A355CD
play PlayMe, xrefs: 00A35617
alias PlayMe, xrefs: 00A355AB

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 7234de2b48c98cf112de4b8952641bf68645f83f03835f8fa2dec93e06afb622
Instruction ID: 16f393101c6728bbbaae5b71b670e66c165f2a0864b15fa9a0f3a6e61c98d702
Opcode Fuzzy Hash: 7234de2b48c98cf112de4b8952641bf68645f83f03835f8fa2dec93e06afb622
Instruction Fuzzy Hash: AB11602499056979E720B7B5CC4AEFFBB7CFFE5B00F44486BB401A61D1EA601E05C6A1

Function 00A348F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00A3490E
gethostname.WSOCK32(?,00000100), ref: 00A34928
gethostbyname.WSOCK32(?), ref: 00A34935
_wcscpy.LIBCMT ref: 00A3495D
_memmove.LIBCMT ref: 00A34970
inet_ntoa.WSOCK32(?), ref: 00A3497B
_strcat.LIBCMT ref: 00A34989
_wcscpy.LIBCMT ref: 00A349A0
WSACleanup.WSOCK32 ref: 00A349AE
_wcscpy.LIBCMT ref: 00A349BC

Strings

0.0.0.0, xrefs: 00A34957

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: fa354d8f502e63c0243909b804fda7a3b24e3ba671904c5d716944a02617e61d
Instruction ID: d28f91d3d04acf3c0b52c5c4e2724a5905597a6170e61b69b2e8442c54a8daa7
Opcode Fuzzy Hash: fa354d8f502e63c0243909b804fda7a3b24e3ba671904c5d716944a02617e61d
Instruction Fuzzy Hash: E111E731904218AFCB20EB74EC46FEB77BCEF44721F0401B6F504960A1EF71AA818791

Function 00A35217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00A3521C

Part of subcall function 009F0719: timeGetTime.WINMM(?,75C0B400,009E0FF9), ref: 009F071D

Sleep.KERNEL32(0000000A), ref: 00A35248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 00A3526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00A3528E
SetActiveWindow.USER32 ref: 00A352AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00A352BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 00A352DA
Sleep.KERNEL32(000000FA), ref: 00A352E5
IsWindow.USER32 ref: 00A352F1
EndDialog.USER32(00000000), ref: 00A35302

Strings

BUTTON, xrefs: 00A35280

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 12a7260028e7415119170aaf78c532bddd0b1b89c38c93b003ea067c9d7c3671
Instruction ID: 3c856db56c1cb38c5a8483bd339328f4761fe49c12f6bee612d373abfd15685b
Opcode Fuzzy Hash: 12a7260028e7415119170aaf78c532bddd0b1b89c38c93b003ea067c9d7c3671
Instruction Fuzzy Hash: 20218C70604704AFE701EBF4EDC9A6A7BA9FB56387F01142AF502861B1DF719C428B72

Function 00A3D7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 009D9997: __itow.LIBCMT ref: 009D99C2
Part of subcall function 009D9997: __swprintf.LIBCMT ref: 009D9A0C

CoInitialize.OLE32(00000000), ref: 00A3D855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00A3D8E8
SHGetDesktopFolder.SHELL32(?), ref: 00A3D8FC
CoCreateInstance.OLE32(00A62D7C,00000000,00000001,00A8A89C,?), ref: 00A3D948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00A3D9B7
CoTaskMemFree.OLE32(?,?), ref: 00A3DA0F
_memset.LIBCMT ref: 00A3DA4C
SHBrowseForFolderW.SHELL32(?), ref: 00A3DA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00A3DAAB
CoTaskMemFree.OLE32(00000000), ref: 00A3DAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00A3DAE9
CoUninitialize.OLE32(00000001,00000000), ref: 00A3DAEB

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: fdc20024b35f6eb7de39a63cd9ffeb96e4937380da2888885c180c4ffa4d19cc
Instruction ID: 572ffa13d4566ea8e248a6e16fae6657007366d4be5466c5f7eb4cacc1f4c714
Opcode Fuzzy Hash: fdc20024b35f6eb7de39a63cd9ffeb96e4937380da2888885c180c4ffa4d19cc
Instruction Fuzzy Hash: 59B1D975A00219EFDB04DFA4D988EAEBBB9FF89304F148469F509EB251DB30AD45CB50

Function 00A3052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00A305A7
SetKeyboardState.USER32(?), ref: 00A30612
GetAsyncKeyState.USER32(000000A0), ref: 00A30632
GetKeyState.USER32(000000A0), ref: 00A30649
GetAsyncKeyState.USER32(000000A1), ref: 00A30678
GetKeyState.USER32(000000A1), ref: 00A30689
GetAsyncKeyState.USER32(00000011), ref: 00A306B5
GetKeyState.USER32(00000011), ref: 00A306C3
GetAsyncKeyState.USER32(00000012), ref: 00A306EC
GetKeyState.USER32(00000012), ref: 00A306FA
GetAsyncKeyState.USER32(0000005B), ref: 00A30723
GetKeyState.USER32(0000005B), ref: 00A30731

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 126bdcc921f953e42b6c820ca82ded0d263dd515ea5425c663075a484937569c
Instruction ID: 07da150de25e8edc916eb8f73aee925a17d783c1557b91cf9b9271c813f9c2da
Opcode Fuzzy Hash: 126bdcc921f953e42b6c820ca82ded0d263dd515ea5425c663075a484937569c
Instruction Fuzzy Hash: 6E51EB60A0478819FB35DBB08965BEABFB49F01380F08859DE5C2561C2EBA49B4CCB55

Function 00A2C72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00A2C746
GetWindowRect.USER32(00000000,?), ref: 00A2C758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00A2C7B6
GetDlgItem.USER32(?,00000002), ref: 00A2C7C1
GetWindowRect.USER32(00000000,?), ref: 00A2C7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00A2C827
GetDlgItem.USER32(?,000003E9), ref: 00A2C835
GetWindowRect.USER32(00000000,?), ref: 00A2C846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00A2C889
GetDlgItem.USER32(?,000003EA), ref: 00A2C897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00A2C8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 00A2C8C1

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 9446fb3a39f30872baa9877c2c4cf791bc396742985d61d76313aa292e4b878b
Instruction ID: 081335003e67dd6603574a574a85f907e8b2a32b918023d7a1d9bd19f6e9bce5
Opcode Fuzzy Hash: 9446fb3a39f30872baa9877c2c4cf791bc396742985d61d76313aa292e4b878b
Instruction Fuzzy Hash: FD511B71B00205AFDB18CFA9DD99AAEBBBAFB88311F14813DF616D7290D7709D018B50

Function 009D201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 009D1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,009D2036,?,00000000,?,?,?,?,009D16CB,00000000,?), ref: 009D1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 009D20D3
KillTimer.USER32(-00000001,?,?,?,?,009D16CB,00000000,?,?,009D1AE2,?,?), ref: 009D216E
DestroyAcceleratorTable.USER32(00000000), ref: 00A0BEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,009D16CB,00000000,?,?,009D1AE2,?,?), ref: 00A0BF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,009D16CB,00000000,?,?,009D1AE2,?,?), ref: 00A0BF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,009D16CB,00000000,?,?,009D1AE2,?,?), ref: 00A0BF5A
DeleteObject.GDI32(00000000), ref: 00A0BF6C

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 2f9ff1db544f2112e412e1fe4b35f45948e7eb02ba354d2f6a562c1a38d0f39c
Instruction ID: 9acfeadfea8241ec4d3225b530f6efc1ce7b5db94bc82f350a8293b1a646c4b1
Opcode Fuzzy Hash: 2f9ff1db544f2112e412e1fe4b35f45948e7eb02ba354d2f6a562c1a38d0f39c
Instruction Fuzzy Hash: 50616C31254605DFCB25DF54DE48B25B7F1FF60316F10C92AE54297AA0CB75A882DF90

Function 009D21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 009D25DB: GetWindowLongW.USER32(?,000000EB), ref: 009D25EC

GetSysColor.USER32(0000000F), ref: 009D21D3

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 02fee34700f7d78d794feada16f642f423fc4aeefa56e37b6a4fff34899ef0cd
Instruction ID: 11580f512990b1e93c4148a3cfa782252f28f59468ae8a6d60627b2bf5d9e636
Opcode Fuzzy Hash: 02fee34700f7d78d794feada16f642f423fc4aeefa56e37b6a4fff34899ef0cd
Instruction Fuzzy Hash: 0B4191311446449FDB259F68EC48BB93B69FB16331F148366FE758A2E2C7318C42DB61

Function 00A3AB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00A5F910), ref: 00A3AB76
GetDriveTypeW.KERNEL32(00000061,00A8A620,00000061), ref: 00A3AC40
_wcscpy.LIBCMT ref: 00A3AC6A

Strings

unknown, xrefs: 00A3AC01
all, xrefs: 00A3AB7C
removable, xrefs: 00A3ABA8
network, xrefs: 00A3ABD4
cdrom, xrefs: 00A3AB92
ramdisk, xrefs: 00A3ABEA
fixed, xrefs: 00A3ABBE

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 654e6b141c514f6bd745d26a9e85c7adf875d850f5687d9dbdca59adbe719e97
Instruction ID: ff02d576a111a20c1eacb72255b6810bb74a7ff8e7db9d056f94dab9589825e5
Opcode Fuzzy Hash: 654e6b141c514f6bd745d26a9e85c7adf875d850f5687d9dbdca59adbe719e97
Instruction Fuzzy Hash: B951AA311483119FC724EF14C881BAAB7A9FFA1300F10882AF5C6972A2DB319D4ACB53

Function 009D9997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 009D99C2
__swprintf.LIBCMT ref: 009D9A0C
__i64tow.LIBCMT ref: 00A0FA0F

Strings

True, xrefs: 00A0F9D0
0x%p, xrefs: 00A0F9F1
%.15g, xrefs: 009D9A06
False, xrefs: 00A0F9D7

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 841c1127737171af497832e4549ed90ca2c9bdc00f718ed9cc2033d87181b238
Instruction ID: 9d5d138c14725acde4e1627ff31376664fc7e156023aa31014a62ce8cbf7e8e3
Opcode Fuzzy Hash: 841c1127737171af497832e4549ed90ca2c9bdc00f718ed9cc2033d87181b238
Instruction Fuzzy Hash: EB41E671544209AFDB34AF78EC42F7673E8EB84340F20886FE649E7291EA759941CB11

Function 00A573C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A573D9
CreateMenu.USER32 ref: 00A573F4
SetMenu.USER32(?,00000000), ref: 00A57403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A57490
IsMenu.USER32(?), ref: 00A574A6
CreatePopupMenu.USER32 ref: 00A574B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00A574DD
DrawMenuBar.USER32 ref: 00A574E5

Strings

0, xrefs: 00A573CF
F, xrefs: 00A574D1

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: df2350b9a14ee6031c457efe126dc7ea5a1f4afaebab011db527e25e9e33f27f
Instruction ID: ab4e85ca6554cc7ce49943c511e12aeef8bf21b86179c2d7db49dfa01075f0f6
Opcode Fuzzy Hash: df2350b9a14ee6031c457efe126dc7ea5a1f4afaebab011db527e25e9e33f27f
Instruction Fuzzy Hash: 18415674A01209EFDB20DFA5E884EAABBF9FF49342F144029FD55A7360DB30A914CB50

Function 00A5772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00A577CD
CreateCompatibleDC.GDI32(00000000), ref: 00A577D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00A577E7
SelectObject.GDI32(00000000,00000000), ref: 00A577EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 00A577FA
DeleteDC.GDI32(00000000), ref: 00A57803
GetWindowLongW.USER32(?,000000EC), ref: 00A5780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00A57821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00A5782D

Strings

static, xrefs: 00A57765

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: dcdc6299be6b629fbc56760a9f35b641af4c8239c106b9e0c5dbd2ea59ea0c63
Instruction ID: 02f53e7fb1534abb0c9bef4753724794152b57458786fbeb44a790454ac75dc1
Opcode Fuzzy Hash: dcdc6299be6b629fbc56760a9f35b641af4c8239c106b9e0c5dbd2ea59ea0c63
Instruction Fuzzy Hash: 7E313632105215BFDF129FA4EC09FDA3B69FF0D322F114225FA15A61A0DB319866DBA4

Function 009F7040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009F707B

Part of subcall function 009F8D68: __getptd_noexit.LIBCMT ref: 009F8D68

__gmtime64_s.LIBCMT ref: 009F7114
__gmtime64_s.LIBCMT ref: 009F714A
__gmtime64_s.LIBCMT ref: 009F7167
__allrem.LIBCMT ref: 009F71BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009F71D9
__allrem.LIBCMT ref: 009F71F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009F720E
__allrem.LIBCMT ref: 009F7225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009F7243
__invoke_watson.LIBCMT ref: 009F72B4

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: 6e836e91b11854c24a0c0fd2e2e1371a2bd16fd1c36bec0a1cf319662169ee5d
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: 5471FB71A0471FABE7149EB9DD41BBAF3ACAF54324F14422AF624D72C1EB70D9408790

Function 00A32A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A32A31
GetMenuItemInfoW.USER32(00A96890,000000FF,00000000,00000030), ref: 00A32A92
SetMenuItemInfoW.USER32(00A96890,00000004,00000000,00000030), ref: 00A32AC8
Sleep.KERNEL32(000001F4), ref: 00A32ADA
GetMenuItemCount.USER32(?), ref: 00A32B1E
GetMenuItemID.USER32(?,00000000), ref: 00A32B3A
GetMenuItemID.USER32(?,-00000001), ref: 00A32B64
GetMenuItemID.USER32(?,?), ref: 00A32BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00A32BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A32C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A32C24

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 1eb70771a65a32ef45f87c91478e77adc72f2954b15af727b349d1d38e6f3441
Instruction ID: af7341e76d458c8e1bddfa9b617cd538b92ed04d7ad7a4c4d52d05f957276c80
Opcode Fuzzy Hash: 1eb70771a65a32ef45f87c91478e77adc72f2954b15af727b349d1d38e6f3441
Instruction Fuzzy Hash: CF618BB0900349AFDB21CFA4D988FBEBBB8FB41344F144569F841A7251EB31AD46DB21

Function 00A57192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00A57214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00A57217
GetWindowLongW.USER32(?,000000F0), ref: 00A5723B
_memset.LIBCMT ref: 00A5724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00A5725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00A572D6

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 42a8b3fc216a80fa03a92c3b0300e6a48f4151353b44ddcbd3bd3752af2932e4
Instruction ID: 0c303e6b3dd8a703d5b888d7c04242381c0347bbfad3cd5eb4f53b51a798eb25
Opcode Fuzzy Hash: 42a8b3fc216a80fa03a92c3b0300e6a48f4151353b44ddcbd3bd3752af2932e4
Instruction Fuzzy Hash: 38615B71A00208AFDB11DFA4DD81EEE77F8BF09710F14415AFE15AB2A1D770AA45DB60

Function 00A2710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00A27135
SafeArrayAllocData.OLEAUT32(?), ref: 00A2718E
VariantInit.OLEAUT32(?), ref: 00A271A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 00A271C0
VariantCopy.OLEAUT32(?,?), ref: 00A27213
SafeArrayUnaccessData.OLEAUT32(?), ref: 00A27227
VariantClear.OLEAUT32(?), ref: 00A2723C
SafeArrayDestroyData.OLEAUT32(?), ref: 00A27249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00A27252
VariantClear.OLEAUT32(?), ref: 00A27264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00A2726F

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 86c3d60f52ad47946ea9319b197df045a9cb245567a439d8b10748cdb4a2d7e8
Instruction ID: 812d45378307502aae68b2b675e140175bd8d742506390787ba80b1b0dd1ac9d
Opcode Fuzzy Hash: 86c3d60f52ad47946ea9319b197df045a9cb245567a439d8b10748cdb4a2d7e8
Instruction Fuzzy Hash: 14412175904229EFCF00EFA8D9449EEBBB9FF48355F008075F955A7261CB30AA46CB90

Function 00A45A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00A45AA6
inet_addr.WSOCK32(?,?,?), ref: 00A45AEB
gethostbyname.WSOCK32(?), ref: 00A45AF7
IcmpCreateFile.IPHLPAPI ref: 00A45B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00A45B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00A45B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00A45C00
WSACleanup.WSOCK32 ref: 00A45C06

Strings

Ping, xrefs: 00A45B29

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 5395b70ae2b50a4d86fff6df9587b04dbe55afcecd2ae6f2ce3467076ef96fff
Instruction ID: 931654ed3e5b2ecfffd8c36a23c8008bb28570057309a6c93255ff703d04051a
Opcode Fuzzy Hash: 5395b70ae2b50a4d86fff6df9587b04dbe55afcecd2ae6f2ce3467076ef96fff
Instruction Fuzzy Hash: A2516E35A447009FD711EF74CC49B2ABBE4EF88750F14892AF555DB2A2EB70E8018B41

Function 00A3B72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A3B73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00A3B7B1
GetLastError.KERNEL32 ref: 00A3B7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 00A3B828

Strings

READY, xrefs: 00A3B801
NOTREADY, xrefs: 00A3B7E7
UNKNOWN, xrefs: 00A3B7E0
INVALID, xrefs: 00A3B7FA
READONLY, xrefs: 00A3B7F3

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 3b47b780e10ff37d46db35c6a1402a88014ea01dd81e597bcf7d7272b82b0908
Instruction ID: 3f754c70abcdd586b176c40d44b707be5b441849f12e1e71f5546485156828f5
Opcode Fuzzy Hash: 3b47b780e10ff37d46db35c6a1402a88014ea01dd81e597bcf7d7272b82b0908
Instruction Fuzzy Hash: 6E31B535A41205AFDB00EF64C885BBEB7B5FF94740F10802BF602D7291DB719942CBA1

Function 00A29471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D7F41: _memmove.LIBCMT ref: 009D7F82

Part of subcall function 00A2B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00A2B0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00A294F6
GetDlgCtrlID.USER32 ref: 00A29501
GetParent.USER32 ref: 00A2951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 00A29520
GetDlgCtrlID.USER32(?), ref: 00A29529
GetParent.USER32(?), ref: 00A29545
SendMessageW.USER32(00000000,?,?,00000111), ref: 00A29548

Strings

ComboBox, xrefs: 00A2947E
ListBox, xrefs: 00A294B3

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 3f6f1dd93bbb9997e128b669834c74bce2138f142b6c8fc146125bfbbdbcd2b7
Instruction ID: 21698bf9b175fda4efbc8dc9902c36c0319b18d882e12025a0cf1629fd005b54
Opcode Fuzzy Hash: 3f6f1dd93bbb9997e128b669834c74bce2138f142b6c8fc146125bfbbdbcd2b7
Instruction Fuzzy Hash: 1821C470A00214BFDF05EBA8DC85EFEBBB4FF45300F104126B561972A2DB755919DB20

Function 00A2955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D7F41: _memmove.LIBCMT ref: 009D7F82

Part of subcall function 00A2B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00A2B0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00A295DF
GetDlgCtrlID.USER32 ref: 00A295EA
GetParent.USER32 ref: 00A29606
SendMessageW.USER32(00000000,?,00000111,?), ref: 00A29609
GetDlgCtrlID.USER32(?), ref: 00A29612
GetParent.USER32(?), ref: 00A2962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00A29631

Strings

ComboBox, xrefs: 00A29569
ListBox, xrefs: 00A2959E

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 67cde146cd4adf1e2469e242e7a69765e7f656d9ad3b386cfee9f81948528663
Instruction ID: 7cd3e94969c5d0cc92980dbeda65ae57abce017bc8d2371b3bb7405c9696093f
Opcode Fuzzy Hash: 67cde146cd4adf1e2469e242e7a69765e7f656d9ad3b386cfee9f81948528663
Instruction Fuzzy Hash: 4121B074A40254BFDF05EBA4DC85EFFBBB8FF48300F144026B921972A1DB7599199B20

Function 00A29645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00A29651
GetClassNameW.USER32(00000000,?,00000100), ref: 00A29666
_wcscmp.LIBCMT ref: 00A29678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00A296F3

Strings

smallicons, xrefs: 00A296BB
details, xrefs: 00A296A1
largeicons, xrefs: 00A29687
SHELLDLL_DefView, xrefs: 00A29672
list, xrefs: 00A296D5

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: e2121bae35a6a1a06506f356c4d55997ca8918c12dce9280d970fc7eb6330f18
Instruction ID: c92413706ade4216085f22a37dc61d6ce91c1dcc02505e2c33ed15835ffbd89c
Opcode Fuzzy Hash: e2121bae35a6a1a06506f356c4d55997ca8918c12dce9280d970fc7eb6330f18
Instruction Fuzzy Hash: ED11297624832BBAFA053768FC0BEB777DCAF04B60F200036FA00A54D1FEA569114B58

Function 00A48BC0 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A48BEC
CoInitialize.OLE32(00000000), ref: 00A48C19
CoUninitialize.OLE32 ref: 00A48C23
GetRunningObjectTable.OLE32(00000000,?), ref: 00A48D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 00A48E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00A62C0C), ref: 00A48E84
CoGetObject.OLE32(?,00000000,00A62C0C,?), ref: 00A48EA7
SetErrorMode.KERNEL32(00000000), ref: 00A48EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00A48F3A
VariantClear.OLEAUT32(?), ref: 00A48F4A

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 1dbadbf4b0e20743b628aea962bf0b33511b62828135f66fe18deb2eee3e4688
Instruction ID: 2fa16857e034e708ccc6b7c97a0543e55b684809201876d44ecc909eb04810a5
Opcode Fuzzy Hash: 1dbadbf4b0e20743b628aea962bf0b33511b62828135f66fe18deb2eee3e4688
Instruction Fuzzy Hash: 58C12375608305AFC700EF68D884A2FB7E9BF89748F00496DF58A9B251DB35ED06CB52

Function 00A34189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00A3419D
__swprintf.LIBCMT ref: 00A341AA

Part of subcall function 009F38D8: __woutput_l.LIBCMT ref: 009F3931

FindResourceW.KERNEL32(?,?,0000000E), ref: 00A341D4
LoadResource.KERNEL32(?,00000000), ref: 00A341E0
LockResource.KERNEL32(00000000), ref: 00A341ED
FindResourceW.KERNEL32(?,?,00000003), ref: 00A3420D
LoadResource.KERNEL32(?,00000000), ref: 00A3421F
SizeofResource.KERNEL32(?,00000000), ref: 00A3422E
LockResource.KERNEL32(?), ref: 00A3423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00A3429B

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: e2bd91456527c775ceff4bf3062fc2f08823d142fa5af6c903fc1ec4c098ef1d
Instruction ID: c64f683a9cea9d7221e06d38b2ff5856572c4f1b50f138b04d60aac712797139
Opcode Fuzzy Hash: e2bd91456527c775ceff4bf3062fc2f08823d142fa5af6c903fc1ec4c098ef1d
Instruction Fuzzy Hash: 08316DB160521AAFDB11DFE0EC48AFF7BA8FF08341F004525F915E2150E774EA528BA0

Function 00A316DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A31700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00A30778,?,00000001), ref: 00A31714
GetWindowThreadProcessId.USER32(00000000), ref: 00A3171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A30778,?,00000001), ref: 00A3172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00A3173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A30778,?,00000001), ref: 00A31755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A30778,?,00000001), ref: 00A31767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00A30778,?,00000001), ref: 00A317AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00A30778,?,00000001), ref: 00A317C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00A30778,?,00000001), ref: 00A317CC

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 1a960e7f396eaba562b04acaf8a34309e77a42afc1ffd681e316775d0691721a
Instruction ID: a6776ce4746b6276327899556559d334d9226d2669323291f8f3d70484e8f85c
Opcode Fuzzy Hash: 1a960e7f396eaba562b04acaf8a34309e77a42afc1ffd681e316775d0691721a
Instruction Fuzzy Hash: 10318C75614304BFEB11DFA4EC88B797BA9AB55712F144026F904A62A0DB749D42CF60

Function 009DFBBD Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 009DFC06
OleUninitialize.OLE32(?,00000000), ref: 009DFCA5
UnregisterHotKey.USER32(?), ref: 009DFDFC
DestroyWindow.USER32(?), ref: 00A14A00
FreeLibrary.KERNEL32(?), ref: 00A14A65
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00A14A92

Strings

close all, xrefs: 009DFC01

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: e110b7150b34c0aa3069038f73a67847ffd7b9e62098c21a963687e74f0739b2
Instruction ID: a01987cfc55b877aa8e5040b5006e5d44466189a5e9c04343ef8b9b965e51493
Opcode Fuzzy Hash: e110b7150b34c0aa3069038f73a67847ffd7b9e62098c21a963687e74f0739b2
Instruction Fuzzy Hash: D4A16D307412128FCB29EF14C5A5B69F764BF48740F1582AEE90AAB362DB30AD56CF54

Function 00A2A693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00A2AA64), ref: 00A2A9A2

Strings

TEXT, xrefs: 00A2A8D9
REGEXPCLASS, xrefs: 00A2A767
CLASS, xrefs: 00A2A721
NAME, xrefs: 00A2A7D4
CLASSNN, xrefs: 00A2A744
INSTANCE, xrefs: 00A2A8B0

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 2a6711d1d6d75f59ddb70a01d33c08489cb99d410f064980d861fde9efedd227
Instruction ID: f2875aba411c1aca86b30fb7667ec90ca4c865e859413bd20194403124b5fcc1
Opcode Fuzzy Hash: 2a6711d1d6d75f59ddb70a01d33c08489cb99d410f064980d861fde9efedd227
Instruction Fuzzy Hash: 2F91E730A0061AEBDB18EF74D481BFAFB74BF54304F148139D98AA7181DF306A99CB91

Function 009D2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 009D2EAE

Part of subcall function 009D1DB3: GetClientRect.USER32(?,?), ref: 009D1DDC
Part of subcall function 009D1DB3: GetWindowRect.USER32(?,?), ref: 009D1E1D
Part of subcall function 009D1DB3: ScreenToClient.USER32(?,?), ref: 009D1E45

GetDC.USER32 ref: 00A0CF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00A0CF95
SelectObject.GDI32(00000000,00000000), ref: 00A0CFA3
SelectObject.GDI32(00000000,00000000), ref: 00A0CFB8
ReleaseDC.USER32(?,00000000), ref: 00A0CFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00A0D04B

Strings

U, xrefs: 00A0CF20

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 125c63561a5933db9a594e7a62a7d8f068e503c111382bc90d16df57ee1d2e31
Instruction ID: a0a6201e46657975d8501d2d1758236798435558efdb85cadcc1fb32422af299
Opcode Fuzzy Hash: 125c63561a5933db9a594e7a62a7d8f068e503c111382bc90d16df57ee1d2e31
Instruction Fuzzy Hash: 5C71C431500209DFCF21DFA4D884AAA7BB6FF48361F14826AED565A2A6C7318C52DB61

Function 00A5C27C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D2612: GetWindowLongW.USER32(?,000000EB), ref: 009D2623

Part of subcall function 009D2344: GetCursorPos.USER32(?), ref: 009D2357
Part of subcall function 009D2344: ScreenToClient.USER32(00A967B0,?), ref: 009D2374
Part of subcall function 009D2344: GetAsyncKeyState.USER32(00000001), ref: 009D2399
Part of subcall function 009D2344: GetAsyncKeyState.USER32(00000002), ref: 009D23A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 00A5C2E4
ImageList_EndDrag.COMCTL32 ref: 00A5C2EA
ReleaseCapture.USER32 ref: 00A5C2F0
SetWindowTextW.USER32(?,00000000), ref: 00A5C39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00A5C3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 00A5C48F

Strings

@GUI_DROPID, xrefs: 00A5C3E1
@GUI_DRAGFILE, xrefs: 00A5C424

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: d628b78653b8c9cebf40112fc55e0ed5034e2bca96170a6feb39535f6574c0f6
Instruction ID: 03028a0abee241c0939cc7189b9001d26ba582eaed483eccea47345aae055f0c
Opcode Fuzzy Hash: d628b78653b8c9cebf40112fc55e0ed5034e2bca96170a6feb39535f6574c0f6
Instruction Fuzzy Hash: 9A518C70204304AFDB00EF64C895F6A7BE5FF88315F00892EF9958B2E1DB71A949CB52

Function 00A48F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00A5F910), ref: 00A4903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00A5F910), ref: 00A49071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00A491EB
SysFreeString.OLEAUT32(?), ref: 00A49215

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 9d42816ab2ba6723d09d1bbfc8b8c9fb1eb74f6bd546d96470be76c93a13f0a4
Instruction ID: 79e8479792fda02206db71bce7b67aadeda80153463df2ccbe930a5c95e98442
Opcode Fuzzy Hash: 9d42816ab2ba6723d09d1bbfc8b8c9fb1eb74f6bd546d96470be76c93a13f0a4
Instruction Fuzzy Hash: F7F12875A00209EFDF04DF98C888EAFB7B9BF89315F108159F515AB290CB71AE56CB50

Function 00A4F9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A4F9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00A4FB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00A4FB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00A4FBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00A4FBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00A4FD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00A4FD90
CloseHandle.KERNEL32(?), ref: 00A4FDBF
CloseHandle.KERNEL32(?), ref: 00A4FE36

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 25431b45f51095236771a3a53b29a1c8ddc8fc80cf10995ab75e42bebcc63b31
Instruction ID: 5d44e98ac83f3ca13a06e39b1d2af2607237817c020c6f9b1348f4f65b2266ca
Opcode Fuzzy Hash: 25431b45f51095236771a3a53b29a1c8ddc8fc80cf10995ab75e42bebcc63b31
Instruction Fuzzy Hash: 68E19C35604341DFCB14EF24C891B6ABBE1AFC5354F14986EF8998B2A2DB31EC45CB52

Function 00A34F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A348AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00A338D3,?), ref: 00A348C7

Part of subcall function 00A348AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00A338D3,?), ref: 00A348E0

Part of subcall function 00A34CD3: GetFileAttributesW.KERNEL32(?,00A33947), ref: 00A34CD4

lstrcmpiW.KERNEL32(?,?), ref: 00A34FE2
_wcscmp.LIBCMT ref: 00A34FFC
MoveFileW.KERNEL32(?,?), ref: 00A35017

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 7ecbdd33ea38257f1e4bfe3e48fef7d54d8b481fd8bb1bf731c26ec8913e4364
Instruction ID: 7d9937f92805efeb5a4313547899b7a015c078ab5fd743a5556ab9a24127d82a
Opcode Fuzzy Hash: 7ecbdd33ea38257f1e4bfe3e48fef7d54d8b481fd8bb1bf731c26ec8913e4364
Instruction Fuzzy Hash: 735176B24087859BC724EBA4D881ADFB3ECAF85341F10492EB285D3151EF75A688C766

Function 00A588B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00A5896E

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: dc3078cf2dc56137bb49eafad9133f140489f2d36135f17519d4bdd3d293b6ba
Instruction ID: 0eabd89bbc77a228e41d4cdf45e82c419b5f2a2d1c033e942ff5ac52f7ac71b1
Opcode Fuzzy Hash: dc3078cf2dc56137bb49eafad9133f140489f2d36135f17519d4bdd3d293b6ba
Instruction Fuzzy Hash: 5751A330600204BFDF24DF68CC85BA93BA5FF15392F604112FE11F66A1DF79A9888B81

Function 009D2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00A0C547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00A0C569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00A0C581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00A0C59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00A0C5C0
DestroyIcon.USER32(00000000), ref: 00A0C5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00A0C5EC
DestroyIcon.USER32(?), ref: 00A0C5FB

Part of subcall function 00A5A71E: DeleteObject.GDI32(00000000), ref: 00A5A757

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 18f22e04525e8328645f496914e4398f5a2b81cf24fe9081e1f7eee7424b84a6
Instruction ID: 0795c6d189785da9c88b7f66de8c406a75347395d0eee2d37f78add19157ed1c
Opcode Fuzzy Hash: 18f22e04525e8328645f496914e4398f5a2b81cf24fe9081e1f7eee7424b84a6
Instruction Fuzzy Hash: C7518D74640209AFDB20DF64DC85FAA77B5FB58321F10862AF902972D0DB74ED81DB50

Function 00A28E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00A28A84,00000B00,?,?), ref: 00A28E0C
HeapAlloc.KERNEL32(00000000,?,00A28A84,00000B00,?,?), ref: 00A28E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00A28A84,00000B00,?,?), ref: 00A28E28
GetCurrentProcess.KERNEL32(?,00000000,?,00A28A84,00000B00,?,?), ref: 00A28E30
DuplicateHandle.KERNEL32(00000000,?,00A28A84,00000B00,?,?), ref: 00A28E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00A28A84,00000B00,?,?), ref: 00A28E43
GetCurrentProcess.KERNEL32(00A28A84,00000000,?,00A28A84,00000B00,?,?), ref: 00A28E4B
DuplicateHandle.KERNEL32(00000000,?,00A28A84,00000B00,?,?), ref: 00A28E4E
CreateThread.KERNEL32(00000000,00000000,00A28E74,00000000,00000000,00000000), ref: 00A28E68

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 2ff94ea5c8e50f96f3c023a9ee400f38c8364c6b5ea42a6b29d31ea087160d4b
Instruction ID: b71ec62a8a5f85624b5e847986ca2ea029eb78495cb05ba9c014aca51ec48300
Opcode Fuzzy Hash: 2ff94ea5c8e50f96f3c023a9ee400f38c8364c6b5ea42a6b29d31ea087160d4b
Instruction Fuzzy Hash: FA01A8B5640708FFE610EBA5DC49F6B3BACFB89711F014521FB05DB1A1CA7498018A20

Function 00A49428 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A4947C
VariantInit.OLEAUT32(?), ref: 00A4954D
VariantInit.OLEAUT32(?), ref: 00A4964E
VariantClear.OLEAUT32(?), ref: 00A49658
VariantClear.OLEAUT32(?), ref: 00A496B5

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00A49631
Null Object assignment in FOR..IN loop, xrefs: 00A494DD, 00A4960B, 00A496C3

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 7c41aff72d35df2e8760971497fe257490de7aa97d247de52015b790c15f16f4
Instruction ID: 6daff56a8fd54395825398ec5cbf6d90e865f40f642e6ba9b4a45f34e7352f66
Opcode Fuzzy Hash: 7c41aff72d35df2e8760971497fe257490de7aa97d247de52015b790c15f16f4
Instruction Fuzzy Hash: BF91BB75A00219AFDF24DFA5C848FAFBBB8EF85310F10855AF519AB280D7709905CFA0

Function 00A49A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00A27652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00A2758C,80070057,?,?,?,00A2799D), ref: 00A2766F
Part of subcall function 00A27652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00A2758C,80070057,?,?), ref: 00A2768A
Part of subcall function 00A27652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00A2758C,80070057,?,?), ref: 00A27698
Part of subcall function 00A27652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00A2758C,80070057,?), ref: 00A276A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00A49B1B
_memset.LIBCMT ref: 00A49B28
_memset.LIBCMT ref: 00A49C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00A49C97
CoTaskMemFree.OLE32(?), ref: 00A49CA2

Strings

NULL Pointer assignment, xrefs: 00A49CF0

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 67839db04ca88d4d15163c51f6f558e96fee4c2c3d7621f6c09a6390d52266b1
Instruction ID: 9fda709ec4986c74dfcc26190242ae77e31d2b78e6bd42ffa3ae73f6927a30fd
Opcode Fuzzy Hash: 67839db04ca88d4d15163c51f6f558e96fee4c2c3d7621f6c09a6390d52266b1
Instruction Fuzzy Hash: A5913A71D00229AFDB10DFA4DC81ADEBBB8BF48310F20815AF519A7241DB315A45CFA0

Function 00A56FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00A57093
SendMessageW.USER32(?,00001036,00000000,?), ref: 00A570A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00A570C1
_wcscat.LIBCMT ref: 00A5711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 00A57133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00A57161

Strings

SysListView32, xrefs: 00A57065

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 6139d73885f5e16f40dd342b82315da8fd15ea9dad5bd5b7736d0414ea00eea8
Instruction ID: d1fdc3de3d3937521d5444d0ef5c275c85ccbe923ee89177b8156c63238c17e0
Opcode Fuzzy Hash: 6139d73885f5e16f40dd342b82315da8fd15ea9dad5bd5b7736d0414ea00eea8
Instruction Fuzzy Hash: CB418E71A04308AFDB219FA4DC85BEEB7E8FF08351F10052AF945A72D2D7719D898B60

Function 00A4EC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00A33E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00A33EB6
Part of subcall function 00A33E91: Process32FirstW.KERNEL32(00000000,?), ref: 00A33EC4
Part of subcall function 00A33E91: CloseHandle.KERNEL32(00000000), ref: 00A33F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A4ECB8
GetLastError.KERNEL32 ref: 00A4ECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A4ECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 00A4ED77
GetLastError.KERNEL32(00000000), ref: 00A4ED82
CloseHandle.KERNEL32(00000000), ref: 00A4EDB7

Strings

SeDebugPrivilege, xrefs: 00A4ECD6

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: f74fc847ff5e11d47c69829e1057951cd28ca3829bd386b3ca6e328ed4d3fca5
Instruction ID: 1328e152ae28bc144f5f5b72e33f22d14b575a80952eab0cf8341325a6ab74da
Opcode Fuzzy Hash: f74fc847ff5e11d47c69829e1057951cd28ca3829bd386b3ca6e328ed4d3fca5
Instruction Fuzzy Hash: 9641A8716002109FDB15EF28CD95F6EB7A1BF80714F188469F9429B3D2DBB5AC04CB96

Function 00A33226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00A332C5

Strings

question, xrefs: 00A3327E
stop, xrefs: 00A33296
info, xrefs: 00A33266
blank, xrefs: 00A33247
warning, xrefs: 00A332AE

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: e121db452da7171ec0fc39de359978e616c7504778cbd3e46c1efeed7495161b
Instruction ID: d2548012ffb6a80154989ef4d9db393e051f7b9ee19856f86bac52889d339fcb
Opcode Fuzzy Hash: e121db452da7171ec0fc39de359978e616c7504778cbd3e46c1efeed7495161b
Instruction Fuzzy Hash: 0D11D53370C34ABAAB016BD4DC42DEBB3ACEF39360F20002AF501A6181E6B55B4047B5

Function 00A34534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00A3454E
LoadStringW.USER32(00000000), ref: 00A34555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00A3456B
LoadStringW.USER32(00000000), ref: 00A34572
_wprintf.LIBCMT ref: 00A34598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00A345B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00A34593

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 7651960312fab53d22babebe7a645500554d2d6dbeb95c6ec157c92b6bfc8165
Instruction ID: 2f2b012ef5b1f304c10cac9fb285eda09818e713c88f634f476244d8c5be72bc
Opcode Fuzzy Hash: 7651960312fab53d22babebe7a645500554d2d6dbeb95c6ec157c92b6bfc8165
Instruction Fuzzy Hash: 0201ECF6900308BFE751E7E49D89EEB766CEB08302F4005A5BB49D2051EA749E858B75

Function 00A5D74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D2612: GetWindowLongW.USER32(?,000000EB), ref: 009D2623

GetSystemMetrics.USER32(0000000F), ref: 00A5D78A
GetSystemMetrics.USER32(0000000F), ref: 00A5D7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00A5D9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00A5DA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00A5DA24
ShowWindow.USER32(00000003,00000000), ref: 00A5DA43
InvalidateRect.USER32(?,00000000,00000001), ref: 00A5DA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 00A5DA8B

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: ff06d095e17fb035f35c3dd820b952f5a150ed867ea01f4c5de605afe8d0ed88
Instruction ID: 510f3ff1c8c62e39eef074dbf5ff3d95dbc8e4eb89e1b404c5bc0fe448fabcec
Opcode Fuzzy Hash: ff06d095e17fb035f35c3dd820b952f5a150ed867ea01f4c5de605afe8d0ed88
Instruction Fuzzy Hash: 73B17871600225EFDF24CF69C9857BE7BB1FF48702F088069ED489B695DB34A958CB90

Function 009D2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00A0C417,00000004,00000000,00000000,00000000), ref: 009D2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00A0C417,00000004,00000000,00000000,00000000,000000FF), ref: 009D2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00A0C417,00000004,00000000,00000000,00000000), ref: 00A0C46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00A0C417,00000004,00000000,00000000,00000000), ref: 00A0C4D6

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: b681b649eb5a8f2dac7addadbe708aee308ea7f800ed1f9f6fe297d84fe2fc04
Instruction ID: 90ef27122eaa23418f50e3f9ee760d07c593268c77ebb7b9fe6973d4f2fb6559
Opcode Fuzzy Hash: b681b649eb5a8f2dac7addadbe708aee308ea7f800ed1f9f6fe297d84fe2fc04
Instruction Fuzzy Hash: D24128303487809ECB358B689CDCB7A3B96FFA6310F54C91BE0474A7E1C6799842D710

Function 00A37368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00A3737F

Part of subcall function 009F0FF6: std::exception::exception.LIBCMT ref: 009F102C
Part of subcall function 009F0FF6: __CxxThrowException@8.LIBCMT ref: 009F1041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00A373B6
EnterCriticalSection.KERNEL32(?), ref: 00A373D2
_memmove.LIBCMT ref: 00A37420
_memmove.LIBCMT ref: 00A3743D
LeaveCriticalSection.KERNEL32(?), ref: 00A3744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00A37461
InterlockedExchange.KERNEL32(?,000001F6), ref: 00A37480

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 9475a5cb9bfeaf1228a1ed89cc6ff0379a70d7fc51b7f5ee18f44551adf7590f
Instruction ID: df93d0d5e2d91fc378a40914e8ff7ab901f89d0a7e947f0db4d7ed2ed37f88d0
Opcode Fuzzy Hash: 9475a5cb9bfeaf1228a1ed89cc6ff0379a70d7fc51b7f5ee18f44551adf7590f
Instruction Fuzzy Hash: C5318D71904209EFDF10DFA4DD85AAFBBB8FF84711F1441A5FA04AB246DB309A11CBA0

Function 00A56442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00A5645A
GetDC.USER32(00000000), ref: 00A56462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A5646D
ReleaseDC.USER32(00000000,00000000), ref: 00A56479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00A564B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00A564C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00A59299,?,?,000000FF,00000000,?,000000FF,?), ref: 00A56500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00A56520

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: d4765ef6e99e76699c2b492e99f1d85df325862a1bd3e7079cc8c9e30e69c389
Instruction ID: 99a3406fae13d5ed894f25d086916c42dff45585e054b8e78406e7d6d01b33db
Opcode Fuzzy Hash: d4765ef6e99e76699c2b492e99f1d85df325862a1bd3e7079cc8c9e30e69c389
Instruction Fuzzy Hash: DF316972241214BFEB118F50CC8AFEB3FA9FF09762F044065FE089A2A1D6759842CB64

Function 00A2C072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00A2C087
_memcmp.LIBCMT ref: 00A2C0A9
_memcmp.LIBCMT ref: 00A2C0C1
_memcmp.LIBCMT ref: 00A2C0D4
_memcmp.LIBCMT ref: 00A2C0EE
_memcmp.LIBCMT ref: 00A2C101
_memcmp.LIBCMT ref: 00A2C119
_memcmp.LIBCMT ref: 00A2C134

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 05b552c48b1efd3753da7f6101be796e47bfb87608a7929281db3e128e820ae1
Instruction ID: 218d5ed00736b1ffe5e0261a37ceb03a8071835b50873e5cc28ae2205f3640a5
Opcode Fuzzy Hash: 05b552c48b1efd3753da7f6101be796e47bfb87608a7929281db3e128e820ae1
Instruction Fuzzy Hash: 2F21C571644629F7D214A629AD42FBF336CAF607B9B040030FE05962C2E752DD2183E5

Function 00A3ED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 009D9997: __itow.LIBCMT ref: 009D99C2
Part of subcall function 009D9997: __swprintf.LIBCMT ref: 009D9A0C

Part of subcall function 009EFEC6: _wcscpy.LIBCMT ref: 009EFEE9

_wcstok.LIBCMT ref: 00A3EEFF
_wcscpy.LIBCMT ref: 00A3EF8E
_memset.LIBCMT ref: 00A3EFC1

Strings

X, xrefs: 00A3EFFE

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 208301cc39336552afab8dbc3901ed3ecf064ee806e5f30a2f6eb112f0eb1cdb
Instruction ID: 2b002829c355b8e558b5beb70da4b9ed7cdb64793b326287b28f7937d4ae994c
Opcode Fuzzy Hash: 208301cc39336552afab8dbc3901ed3ecf064ee806e5f30a2f6eb112f0eb1cdb
Instruction Fuzzy Hash: 05C170315487009FC724EF28C981B6AB7E4BF85310F04892EF999973A2DB70ED45CB82

Function 009D1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c6463f5f5451808c2c92ba89e31a40af1f4dd04a472907d213a68cc7e2ac3b
Instruction ID: b92071e573d49416a72647803e184f5a9bce3aade930048b764370e7295b4960
Opcode Fuzzy Hash: e9c6463f5f5451808c2c92ba89e31a40af1f4dd04a472907d213a68cc7e2ac3b
Instruction Fuzzy Hash: 0C715831940109FFCB04DF98DD89AAEBB79FF85314F14C15AF915AB2A1C734AA51CBA0

Function 00A46E8A Relevance: 10.7, APIs: 7, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb6ae3662aee9a8d474b015ebaaeaec2f805fdca21bceff91be85040af66af1
Instruction ID: e65e32a4da626e12aa2de30b9b9380d3de935ab0795a852107d17f71b3d3b490
Opcode Fuzzy Hash: 1bb6ae3662aee9a8d474b015ebaaeaec2f805fdca21bceff91be85040af66af1
Instruction Fuzzy Hash: 3F61AA76108310AFC710EB24CC82F6FB7E9AFC4714F508A1AF556972A2DB70AD05CB92

Function 00A5B60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01395B30), ref: 00A5B6A5
IsWindowEnabled.USER32(01395B30), ref: 00A5B6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00A5B795
SendMessageW.USER32(01395B30,000000B0,?,?), ref: 00A5B7CC
IsDlgButtonChecked.USER32(?,?), ref: 00A5B809
GetWindowLongW.USER32(01395B30,000000EC), ref: 00A5B82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00A5B843

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 71e2ed381bd86780fef1d731dcf2801376a16519b7d6de4d0665c5b881502405
Instruction ID: e4b6fa56a6689b292c3ad9166d3365e1847ec4718d7c55bdbd3f8edd78c718cf
Opcode Fuzzy Hash: 71e2ed381bd86780fef1d731dcf2801376a16519b7d6de4d0665c5b881502405
Instruction Fuzzy Hash: A4718B74611204AFDB20DFA4C8A4FAABBB9FF89343F144069FD45972A1C731A949CB60

Function 00A4F732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A4F75C
_memset.LIBCMT ref: 00A4F825
ShellExecuteExW.SHELL32(?), ref: 00A4F86A

Part of subcall function 009D9997: __itow.LIBCMT ref: 009D99C2
Part of subcall function 009D9997: __swprintf.LIBCMT ref: 009D9A0C

Part of subcall function 009EFEC6: _wcscpy.LIBCMT ref: 009EFEE9

GetProcessId.KERNEL32(00000000), ref: 00A4F8E1
CloseHandle.KERNEL32(00000000), ref: 00A4F910

Strings

@, xrefs: 00A4F839

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 47f8e8b7cb1fe8133d4597e385ab3d44cfa748132674375db8c054135ef48dc6
Instruction ID: 397f51ae4b25bf0bee6cbb5fe508dce829192cad49cbec351a9a0ea32c76c39e
Opcode Fuzzy Hash: 47f8e8b7cb1fe8133d4597e385ab3d44cfa748132674375db8c054135ef48dc6
Instruction Fuzzy Hash: 8061A179A00619DFCF14EF64C590AAEBBF5FF88310F14946AE856AB351CB30AD41CB90

Function 00A3145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00A3149C
GetKeyboardState.USER32(?), ref: 00A314B1
SetKeyboardState.USER32(?), ref: 00A31512
PostMessageW.USER32(?,00000101,00000010,?), ref: 00A31540
PostMessageW.USER32(?,00000101,00000011,?), ref: 00A3155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00A315A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00A315C8

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 4e0a4e892b4e7868713fc632f731793e332bd5bb0827c9af3fbf87859c35521c
Instruction ID: 0830a947f74f332afaf499a98fdf97e3d02b6af63fc11b0a60f3c0e32c51400b
Opcode Fuzzy Hash: 4e0a4e892b4e7868713fc632f731793e332bd5bb0827c9af3fbf87859c35521c
Instruction Fuzzy Hash: 1D5102A0A047D53EFB3243748C46BBABEA96B46304F0C8489F1D6468C2D7E9ECD4D760

Function 00A31276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00A312B5
GetKeyboardState.USER32(?), ref: 00A312CA
SetKeyboardState.USER32(?), ref: 00A3132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00A31357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00A31374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00A313B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00A313D9

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: d5d2a62aee2db215ada78966cfcc9ae9252445c3cfbc0c9232a63cc51c65f8f4
Instruction ID: 226ff464368029938105d0a975ead22237dcd1677c5127e31707e1099bdd454b
Opcode Fuzzy Hash: d5d2a62aee2db215ada78966cfcc9ae9252445c3cfbc0c9232a63cc51c65f8f4
Instruction Fuzzy Hash: 9F51E3A0A047D53DFB3287648C45BBABFA96F06300F088989F1D54ACC2D795EC98D760

Function 00A3589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00A358AC
_wcsncpy.LIBCMT ref: 00A358E1
_wcsncpy.LIBCMT ref: 00A35913
_wcsncpy.LIBCMT ref: 00A35946
_wcsncpy.LIBCMT ref: 00A35988
_wcsncpy.LIBCMT ref: 00A359C2
_wcsncpy.LIBCMT ref: 00A359F1

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 8edaacb7eefa7543aa75efe855eec2c9ee2600bb1d5618a42250f551c64034cf
Instruction ID: b428f85eb586218c44a1f1548b210ede6fbdf760f6389ce6ca65daef4a4be1fc
Opcode Fuzzy Hash: 8edaacb7eefa7543aa75efe855eec2c9ee2600bb1d5618a42250f551c64034cf
Instruction Fuzzy Hash: 9B4192A5C2161C76CB10FBB88C8ABDFB7A89F44310F608566F618E3121E734E715C7A9

Function 00A338AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A348AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00A338D3,?), ref: 00A348C7

Part of subcall function 00A348AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00A338D3,?), ref: 00A348E0

lstrcmpiW.KERNEL32(?,?), ref: 00A338F3
_wcscmp.LIBCMT ref: 00A3390F
MoveFileW.KERNEL32(?,?), ref: 00A33927
_wcscat.LIBCMT ref: 00A3396F
SHFileOperationW.SHELL32(?), ref: 00A339DB

Strings

\*.*, xrefs: 00A33969

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 827619b8d87f7ec667d4c187d8ec7d1f274d789ac6c132ac0cf3757000c0cdd0
Instruction ID: 2c7b1b90536b79d5b7a5acee9dd4f4480cd2b33c7da8b19d06c45f80d621c9f4
Opcode Fuzzy Hash: 827619b8d87f7ec667d4c187d8ec7d1f274d789ac6c132ac0cf3757000c0cdd0
Instruction Fuzzy Hash: A6419FB250C3849ECB51EF64D491AEFB7E8EF89350F10192EB48AC3251EB74D688C752

Function 00A57500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A57519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A575C0
IsMenu.USER32(?), ref: 00A575D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00A57620
DrawMenuBar.USER32 ref: 00A57633

Strings

0, xrefs: 00A5750D

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 60a8c7a484b8a0f0e746e2f6a6953a97c709abe76fb2497e8bf9d1dc2966b561
Instruction ID: 17c513d7792877c9ab1f29b99827cb8c933dff5dece5f242f535ccfb11e505d4
Opcode Fuzzy Hash: 60a8c7a484b8a0f0e746e2f6a6953a97c709abe76fb2497e8bf9d1dc2966b561
Instruction Fuzzy Hash: 5F412675A04649AFDB20DF94E884EAABBF8FF08351F048129ED15A7650DB30AD55CFA0

Function 00A5122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00A5125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A51286
FreeLibrary.KERNEL32(00000000), ref: 00A5133D

Part of subcall function 00A5122D: RegCloseKey.ADVAPI32(?), ref: 00A512A3
Part of subcall function 00A5122D: FreeLibrary.KERNEL32(?), ref: 00A512F5
Part of subcall function 00A5122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00A51318

RegDeleteKeyW.ADVAPI32(?,?), ref: 00A512E0

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: bc476453105d8202e485e94e77911643d758c75d8a9697565679e2365a92057f
Instruction ID: a8fd556ab9666b4909561331879a1cdf2dd6e257fe41727d4e60b65dd54aabf2
Opcode Fuzzy Hash: bc476453105d8202e485e94e77911643d758c75d8a9697565679e2365a92057f
Instruction Fuzzy Hash: 72310AB1901219BFDB15DBD0DC99EFFB7BCFB08312F000169E911E6151EA749E899AA0

Function 00A5653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00A5655B
GetWindowLongW.USER32(01395B30,000000F0), ref: 00A5658E
GetWindowLongW.USER32(01395B30,000000F0), ref: 00A565C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00A565F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00A5661F
GetWindowLongW.USER32(00000000,000000F0), ref: 00A56630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00A5664A

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 3926fe6fa5cfb11a897ad32948277876b3dd743f30e31dacb26d6bf02f64bda8
Instruction ID: 9b9391aade05f8e0afd9c166b0c20a0162d05600ce6d4fbc1c6a13297589618a
Opcode Fuzzy Hash: 3926fe6fa5cfb11a897ad32948277876b3dd743f30e31dacb26d6bf02f64bda8
Instruction Fuzzy Hash: 57312430644250AFDB20CF98DC84F553BE1FB5A352F9841A9F9018B6B5DB71AC49DB41

Function 00A46486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A480A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00A480CB

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00A464D9
WSAGetLastError.WSOCK32(00000000), ref: 00A464E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00A46521
connect.WSOCK32(00000000,?,00000010), ref: 00A4652A
WSAGetLastError.WSOCK32 ref: 00A46534
closesocket.WSOCK32(00000000), ref: 00A4655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00A46576

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 31324852e8b7f35662e434db09cde18c0d3b2a8103417760ba31ab7bc5a90dfb
Instruction ID: aecf209928a2a224e920e285225f987cc5d8da90ed3a939c044d99ac16831479
Opcode Fuzzy Hash: 31324852e8b7f35662e434db09cde18c0d3b2a8103417760ba31ab7bc5a90dfb
Instruction Fuzzy Hash: 2931B135600218AFDF10EF64DD85BBE7BBCEB85711F048029F90997291DB74AD05CBA2

Function 00A2E0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A2E0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A2E120
SysAllocString.OLEAUT32(00000000), ref: 00A2E123
SysAllocString.OLEAUT32 ref: 00A2E144
SysFreeString.OLEAUT32 ref: 00A2E14D
StringFromGUID2.OLE32(?,?,00000028), ref: 00A2E167
SysAllocString.OLEAUT32(?), ref: 00A2E175

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: fe002da72b1bb40e95513daa4ae4c46d6f95c2b218dacbee20f76d7425bc2e0c
Instruction ID: 2c43c90ee0cb976bc30d662573a3dd9180ef2aa55833b229d1a8381ccb9f7097
Opcode Fuzzy Hash: fe002da72b1bb40e95513daa4ae4c46d6f95c2b218dacbee20f76d7425bc2e0c
Instruction Fuzzy Hash: D6213235605218AFDB10DFACDC88DAB77ACFB19760B108235F915CB2A1DA70DC828B64

Function 00A2FB6E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00A2FB81
__wcsnicmp.LIBCMT ref: 00A2FBA2
__wcsnicmp.LIBCMT ref: 00A2FBBC

Strings

#OnAutoItStartRegister, xrefs: 00A2FBB6
#requireadmin, xrefs: 00A2FB9C
#notrayicon, xrefs: 00A2FB79

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 1567eb20d9475ea251e8b5a56c4bf9396daf98809c93b86a6e37c17f2533a465
Instruction ID: bdd94561c82a95a7d7d686d5b6f93a83b6096b31306b4ac676a891ccd5357800
Opcode Fuzzy Hash: 1567eb20d9475ea251e8b5a56c4bf9396daf98809c93b86a6e37c17f2533a465
Instruction Fuzzy Hash: 0C213772104565BED631A728EE12FB7B3B8EF91340F148436FD8687181EB51AD81D791

Function 00A5783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 009D1D73
Part of subcall function 009D1D35: GetStockObject.GDI32(00000011), ref: 009D1D87
Part of subcall function 009D1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 009D1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00A578A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00A578AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00A578B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00A578C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00A578D4

Strings

Msctls_Progress32, xrefs: 00A57872

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 318ecdd304517f6368bbfcc3445ae55e74b5c478458469a4f00615cf7cd002e7
Instruction ID: 5b676a5f68ffe0a0d4e1c1c410b4f450e44cbb0ce6a992b00cfa4218422f78d9
Opcode Fuzzy Hash: 318ecdd304517f6368bbfcc3445ae55e74b5c478458469a4f00615cf7cd002e7
Instruction Fuzzy Hash: 5B1160B2550219BFEF159FA0CC85EEB7F6DFF08768F014115BA04A6090CB72AC61DBA4

Function 009F41C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,009F4292,?), ref: 009F41E3
GetProcAddress.KERNEL32(00000000), ref: 009F41EA
EncodePointer.KERNEL32(00000000), ref: 009F41F6
DecodePointer.KERNEL32(00000001,009F4292,?), ref: 009F4213

Strings

RoInitialize, xrefs: 009F41D2
combase.dll, xrefs: 009F41DE

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 4e32315a316c631c2d85143dbe572c683ba30bb7e2e8570339d1e33ede0b9aed
Instruction ID: 461f17a022459760d56ba0518407151fc9cf98ac4a76e423574ff5f15397d62b
Opcode Fuzzy Hash: 4e32315a316c631c2d85143dbe572c683ba30bb7e2e8570339d1e33ede0b9aed
Instruction Fuzzy Hash: 7AE0EDB0690B00AEEB10ABF0EC09F5536E4B724743F204925B521D50A0DAB540938B00

Function 009F429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,009F41B8), ref: 009F42B8
GetProcAddress.KERNEL32(00000000), ref: 009F42BF
EncodePointer.KERNEL32(00000000), ref: 009F42CA
DecodePointer.KERNEL32(009F41B8), ref: 009F42E5

Strings

combase.dll, xrefs: 009F42B3
RoUninitialize, xrefs: 009F42A7

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 5b0aee64e40af6f7955747a311014bb850d97f9dac4edb5a1522419e8ab1cbde
Instruction ID: 39f792ba5185ffd0b771b91ce39533c8437afd7199d770018fb39476af4dcab5
Opcode Fuzzy Hash: 5b0aee64e40af6f7955747a311014bb850d97f9dac4edb5a1522419e8ab1cbde
Instruction Fuzzy Hash: 47E09A78641700EFEA10DBA0EC09F563AA4B718746F204526F115D50B0CF744543CB14

Function 00A3675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A368AD
_memmove.LIBCMT ref: 00A367E8

Part of subcall function 009D9997: __itow.LIBCMT ref: 009D99C2
Part of subcall function 009D9997: __swprintf.LIBCMT ref: 009D9A0C

_memmove.LIBCMT ref: 00A3685B
_memmove.LIBCMT ref: 00A36942
_memmove.LIBCMT ref: 00A3695B
_memmove.LIBCMT ref: 00A36977

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 1347be9f1f4028bf595c74e1ca37d754460415366fd3933d447e99c3041e9c04
Instruction ID: 340252ffd68b694fb6495bd8aeea99972bf1684cbee35b1f4edcfa4a6d88c84b
Opcode Fuzzy Hash: 1347be9f1f4028bf595c74e1ca37d754460415366fd3933d447e99c3041e9c04
Instruction Fuzzy Hash: B761BF3054065AABCF11FF64CC92FFE77A8AF84308F04851AF9595B292DB349D51CB90

Function 00A5046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009D7F41: _memmove.LIBCMT ref: 009D7F82

Part of subcall function 00A510A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A50038,?,?), ref: 00A510BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A50548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A50588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00A505AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00A505D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00A50617
RegCloseKey.ADVAPI32(00000000), ref: 00A50624

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: c8191fa5a7325f6b9b1112331b20d5e3d46d4bd0e77ff12c6fae52297620e922
Instruction ID: 2679017af591ad94bb7634992ae16ba6db2988b67125ffc82d70e4b8e17b3b48
Opcode Fuzzy Hash: c8191fa5a7325f6b9b1112331b20d5e3d46d4bd0e77ff12c6fae52297620e922
Instruction Fuzzy Hash: 1B513931108200AFCB14EF64C885E6EBBF8FF84355F04892EF945972A1EB71E909CB52

Function 00A55A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00A55A82
GetMenuItemCount.USER32(00000000), ref: 00A55AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00A55AE1
GetMenuItemID.USER32(?,?), ref: 00A55B50
GetSubMenu.USER32(?,?), ref: 00A55B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 00A55BAF

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 8bd605e1ced5a3b059d6168e4ec0d9f780083a25db028f1e4b04f5dd4c6efeab
Instruction ID: 59ec25aecb2f11925dc8752937b1f00b572a8c956f690e2d401174755d27c9c2
Opcode Fuzzy Hash: 8bd605e1ced5a3b059d6168e4ec0d9f780083a25db028f1e4b04f5dd4c6efeab
Instruction Fuzzy Hash: 42515935E00619EFCF15EFA4C959AAEB7B4FF48321F11446AED01AB351DB30AE458B90

Function 00A2F3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A2F3F7
VariantClear.OLEAUT32(00000013), ref: 00A2F469
VariantClear.OLEAUT32(00000000), ref: 00A2F4C4
_memmove.LIBCMT ref: 00A2F4EE
VariantClear.OLEAUT32(?), ref: 00A2F53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00A2F569

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: f68342505f4d1b55df57d733994c44fa37be25d27417e82a11d2734ae462f7b4
Instruction ID: bb3c8653e7517ca974ef3b45c7977142ff674289453c88dda46517daeecdc947
Opcode Fuzzy Hash: f68342505f4d1b55df57d733994c44fa37be25d27417e82a11d2734ae462f7b4
Instruction Fuzzy Hash: 0A5148B5A00219EFCB14DF58D884AAAB7B8FF4C354B15856AED59DB310D730E912CFA0

Function 00A326F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A32747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A32792
IsMenu.USER32(00000000), ref: 00A327B2
CreatePopupMenu.USER32 ref: 00A327E6
GetMenuItemCount.USER32(000000FF), ref: 00A32844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00A32875

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 3b75f78c6fb5c24fa223020242f847c4b76e67f116b626553209786bc59181fd
Instruction ID: 2de2a8f3691208d8792e2d09df2f5e59041e5565a32b150628e4862256005f29
Opcode Fuzzy Hash: 3b75f78c6fb5c24fa223020242f847c4b76e67f116b626553209786bc59181fd
Instruction Fuzzy Hash: C151BE70A0030AEFDF25CFA8D988BAEBBF5BF44314F104269F8119B291E7709945CB51

Function 009D1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 009D2612: GetWindowLongW.USER32(?,000000EB), ref: 009D2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 009D179A
GetWindowRect.USER32(?,?), ref: 009D17FE
ScreenToClient.USER32(?,?), ref: 009D181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 009D182C
EndPaint.USER32(?,?), ref: 009D1876

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 5c723b2d85eae802d38f07169cb66ed701e108e06e2fdcca4dd99b1fc5ca6112
Instruction ID: f4de796c8189407513190579ebc87bbbef4383a68994d3772bd7b4e5c056a143
Opcode Fuzzy Hash: 5c723b2d85eae802d38f07169cb66ed701e108e06e2fdcca4dd99b1fc5ca6112
Instruction Fuzzy Hash: A741AF71204300AFDB10DF65DC84FBA7BE8FF49764F04862AF994872A1CB319846DB61

Function 00A5B958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00A967B0,00000000,01395B30,?,?,00A967B0,?,00A5B862,?,?), ref: 00A5B9CC
EnableWindow.USER32(00000000,00000000), ref: 00A5B9F0
ShowWindow.USER32(00A967B0,00000000,01395B30,?,?,00A967B0,?,00A5B862,?,?), ref: 00A5BA50
ShowWindow.USER32(00000000,00000004,?,00A5B862,?,?), ref: 00A5BA62
EnableWindow.USER32(00000000,00000001), ref: 00A5BA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00A5BAA9

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: e763c9317ffe9fdff7f782d75a811c04445ac9f921cb874c508ac016aebf0b4c
Instruction ID: acfb86ef0fd0b1154f1e3cee6e00368dd649bdb2a8e7a4d1ee4af1ef7e78f064
Opcode Fuzzy Hash: e763c9317ffe9fdff7f782d75a811c04445ac9f921cb874c508ac016aebf0b4c
Instruction Fuzzy Hash: B3413034610241EFDB26CF54C889B957BE1BB05357F1842B9FE488F6A2C731A84ACB61

Function 00A473B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00A45134,?,?,00000000,00000001), ref: 00A473BF

Part of subcall function 00A43C94: GetWindowRect.USER32(?,?), ref: 00A43CA7

GetDesktopWindow.USER32 ref: 00A473E9
GetWindowRect.USER32(00000000), ref: 00A473F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00A47422

Part of subcall function 00A354E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A3555E

GetCursorPos.USER32(?), ref: 00A4744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00A474AC

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 823ff04aba545336dfcdf0fca2f1e24ad556ee2e2a9a02dfa15c590d52d25df2
Instruction ID: bbe6ab096ada4e6e701e50b58bdc0723f06f204f3f965f0ea767bf670dc666bf
Opcode Fuzzy Hash: 823ff04aba545336dfcdf0fca2f1e24ad556ee2e2a9a02dfa15c590d52d25df2
Instruction Fuzzy Hash: A631B272508355AFD720DF64D849EAFBBA9FF88314F000919F58997191DB30EA09CB92

Function 00A28D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A285F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00A28608
Part of subcall function 00A285F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00A28612
Part of subcall function 00A285F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00A28621
Part of subcall function 00A285F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00A28628
Part of subcall function 00A285F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00A2863E

GetLengthSid.ADVAPI32(?,00000000,00A28977), ref: 00A28DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00A28DB8
HeapAlloc.KERNEL32(00000000), ref: 00A28DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 00A28DD8
GetProcessHeap.KERNEL32(00000000,00000000,00A28977), ref: 00A28DEC
HeapFree.KERNEL32(00000000), ref: 00A28DF3

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: efc8cdb8e4a2460532c3b63439341f64c85be56cd49dbc4a81a2c139469604d0
Instruction ID: 1c523543a5c56ffa8829948e81971df6f2e716183d5069a5ef3b9635d0e435e4
Opcode Fuzzy Hash: efc8cdb8e4a2460532c3b63439341f64c85be56cd49dbc4a81a2c139469604d0
Instruction Fuzzy Hash: 9F11EE31502614FFDB10DFA8EC08BAE7BB9FF55316F108129F84593290DB3AA909CB60

Function 00A28AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00A28B2A
OpenProcessToken.ADVAPI32(00000000), ref: 00A28B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00A28B40
CloseHandle.KERNEL32(00000004), ref: 00A28B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00A28B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 00A28B8E

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 81e56da8cd176fd104192ae6966d8e9c2b6d07b33eb948acd59e4a41897b06cb
Instruction ID: b289395f2c52037dec218817ead180cebd969b34feb95257cb2eb1207dc8d52c
Opcode Fuzzy Hash: 81e56da8cd176fd104192ae6966d8e9c2b6d07b33eb948acd59e4a41897b06cb
Instruction Fuzzy Hash: 301159B2501209AFDF01CFA8ED49FDE7BA9FF08305F044068FE04A2160C7768D61AB60

Function 00A5C19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 009D12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009D134D
Part of subcall function 009D12F3: SelectObject.GDI32(?,00000000), ref: 009D135C
Part of subcall function 009D12F3: BeginPath.GDI32(?), ref: 009D1373
Part of subcall function 009D12F3: SelectObject.GDI32(?,00000000), ref: 009D139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00A5C1C4
LineTo.GDI32(00000000,00000003,?), ref: 00A5C1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00A5C1E6
LineTo.GDI32(00000000,00000000,?), ref: 00A5C1F6
EndPath.GDI32(00000000), ref: 00A5C206
StrokePath.GDI32(00000000), ref: 00A5C216

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 78ac9d65a3b3964d13974dc055db90fc4f17b064a7f30846c6032c46788f0d96
Instruction ID: 87493f7cbc6e8ce0e789403010459026dbd13ddb277cec27691f526f59dfacfc
Opcode Fuzzy Hash: 78ac9d65a3b3964d13974dc055db90fc4f17b064a7f30846c6032c46788f0d96
Instruction Fuzzy Hash: 05110C7644020CBFDF119F90DC48EDA7FADFF04355F048021BA18461A1D7729D55DBA0

Function 009F03A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 009F03D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 009F03DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 009F03E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 009F03F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 009F03F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 009F0401

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 913dd780ce9bdb3fc932f8c950304dd1a3373417c5238868851a7f235614866f
Instruction ID: c665734fc5d1d9266cb1f4d147d39db99c7c548a61cf66ec6f1855878e00a7d8
Opcode Fuzzy Hash: 913dd780ce9bdb3fc932f8c950304dd1a3373417c5238868851a7f235614866f
Instruction Fuzzy Hash: 1F016CB09017597DE3009F5A8C85B52FFE8FF19354F00411BA15C47941C7F5A864CBE5

Function 00A3568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00A3569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00A356B1
GetWindowThreadProcessId.USER32(?,?), ref: 00A356C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A356CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A356D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A356E0

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 98b93d3ce01b305c300408dddfd7e1134fcd474a420f5b84d8db88f62d46ee9f
Instruction ID: 0c2980e47271477e6ef76c54311425016d8cc0b1cd15eb7e291470cfffe0a510
Opcode Fuzzy Hash: 98b93d3ce01b305c300408dddfd7e1134fcd474a420f5b84d8db88f62d46ee9f
Instruction Fuzzy Hash: A9F01231541658BFE7219BA29C0DEAB7B7CFBC6B12F000169FA04D105197B11A0286B5

Function 00A374D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00A374E5
EnterCriticalSection.KERNEL32(?,?,009E1044,?,?), ref: 00A374F6
TerminateThread.KERNEL32(00000000,000001F6,?,009E1044,?,?), ref: 00A37503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,009E1044,?,?), ref: 00A37510

Part of subcall function 00A36ED7: CloseHandle.KERNEL32(00000000,?,00A3751D,?,009E1044,?,?), ref: 00A36EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00A37523
LeaveCriticalSection.KERNEL32(?,?,009E1044,?,?), ref: 00A3752A

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 38268a4f0eb72154eab1d97d618c02e6cd870da2ae3820c4498f137d7059650b
Instruction ID: 3daba37dab6defb0233a43035a92ba05479dba82d82429ee7f9d25b671128a01
Opcode Fuzzy Hash: 38268a4f0eb72154eab1d97d618c02e6cd870da2ae3820c4498f137d7059650b
Instruction Fuzzy Hash: DAF03ABA141712AFEB116BA4ED8CAEF772ABF45703F100531F202914A0CF755802CA50

Function 00A28E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A28E7F
UnloadUserProfile.USERENV(?,?), ref: 00A28E8B
CloseHandle.KERNEL32(?), ref: 00A28E94
CloseHandle.KERNEL32(?), ref: 00A28E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 00A28EA5
HeapFree.KERNEL32(00000000), ref: 00A28EAC

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: f10b7e62c6a59b5d9d57c5a1e5ae145dee614cf9f5a66455c72500a3b632583e
Instruction ID: ade756fdbdf3b52204d88d74317fc3ee1f2504931c667ebd794b092dadf4eb9b
Opcode Fuzzy Hash: f10b7e62c6a59b5d9d57c5a1e5ae145dee614cf9f5a66455c72500a3b632583e
Instruction Fuzzy Hash: C2E0C236004601FFDA01AFE1EC0C90ABB69FB99323B108230F32985470CB32A422DB50

Function 00A48902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A48928
CharUpperBuffW.USER32(?,?), ref: 00A48A37
VariantClear.OLEAUT32(?), ref: 00A48BAF

Part of subcall function 00A37804: VariantInit.OLEAUT32(00000000), ref: 00A37844
Part of subcall function 00A37804: VariantCopy.OLEAUT32(00000000,?), ref: 00A3784D
Part of subcall function 00A37804: VariantClear.OLEAUT32(00000000), ref: 00A37859

Strings

Incorrect Parameter format, xrefs: 00A48960, 00A48B22
AUTOIT.ERROR, xrefs: 00A48A3D

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 138ae03a9b3fc9cb6d34f71612b6b4570cdd2e6afec580d6f1dc8a33e80aacf5
Instruction ID: a745919ed839136c16d5f3af5bed565853dacb539cae6c29479f4d8e356f8b66
Opcode Fuzzy Hash: 138ae03a9b3fc9cb6d34f71612b6b4570cdd2e6afec580d6f1dc8a33e80aacf5
Instruction Fuzzy Hash: DF915B756047019FC710EF28D58095EBBE4EFC9354F04896EF89A8B362DB30E946CB52

Function 00A32F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009EFEC6: _wcscpy.LIBCMT ref: 009EFEE9

_memset.LIBCMT ref: 00A33077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A330A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A33159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00A33187

Strings

0, xrefs: 00A33063

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 6c5a1f6b312384601dac1edd53eae7f1ccb8a871782de634f3c06616b4bba66f
Instruction ID: 9dbedbd4eba0975e500c389cd9de26f8fe281856be0a112008eb9403ecef2a1e
Opcode Fuzzy Hash: 6c5a1f6b312384601dac1edd53eae7f1ccb8a871782de634f3c06616b4bba66f
Instruction Fuzzy Hash: 4951807261C300ABDF259F28D845B6BBBE4EF85360F044A2EF995D7291DB70CE448792

Function 00A2DA5D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00A2DAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00A2DAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00A2DB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00A2DB8E

Strings

DllGetClassObject, xrefs: 00A2DB01

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: add7e3a82ba53264af42d66a0e4babacf8bbe8db18ac65dbe512bc62a669bf68
Instruction ID: c4cd1902d79b31cae7e38c3da2df200b5d014ee157628d5ec1df61348448deae
Opcode Fuzzy Hash: add7e3a82ba53264af42d66a0e4babacf8bbe8db18ac65dbe512bc62a669bf68
Instruction Fuzzy Hash: 51419FB1600218EFDB15CF68D984A9ABBB9FF44350F1581BAAD05DF246D7B1DD40CBA0

Function 00A32C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A32CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00A32CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 00A32D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00A96890,00000000), ref: 00A32D5A

Strings

0, xrefs: 00A32CA4

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 654f399ba6a81eaf5d6c6c4e4f5d6879853f304925414853b43e403604500533
Instruction ID: 707ad327f6b75c34ceb7e5a1ea4cd764f06a60d587d55851980b9a0571e32945
Opcode Fuzzy Hash: 654f399ba6a81eaf5d6c6c4e4f5d6879853f304925414853b43e403604500533
Instruction Fuzzy Hash: 5441AF30204302AFD720DF24D885B5BBBE8FF85360F14466EF965972A1DB70E905CBA2

Function 00A4DAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00A4DAD9

Part of subcall function 009D79AB: _memmove.LIBCMT ref: 009D79F9

Strings

cdecl, xrefs: 00A4DB30
stdcall, xrefs: 00A4DB5B
winapi, xrefs: 00A4DB4A
none, xrefs: 00A4DBB4

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: eb5bb29982c224f7d0e4d355479ae19827de96cc3a1890380c3afc746415979c
Instruction ID: ce851cf21ccf3d834a9117a13d7c103d148327ef371a17edf4b62c9cfa0b7ff2
Opcode Fuzzy Hash: eb5bb29982c224f7d0e4d355479ae19827de96cc3a1890380c3afc746415979c
Instruction Fuzzy Hash: 9331887550061A9FCF10EF94CC81AFEB7B4FF85710B10862AE865A77D1DB71A906CB90

Function 00A29372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D7F41: _memmove.LIBCMT ref: 009D7F82

Part of subcall function 00A2B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00A2B0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00A293F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00A29409
SendMessageW.USER32(?,00000189,?,00000000), ref: 00A29439

Part of subcall function 009D7D2C: _memmove.LIBCMT ref: 009D7D66

Strings

ComboBox, xrefs: 00A29380
ListBox, xrefs: 00A293B5

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 2ce9c1107f0c934e22e64900501b8baf96be11492b81056775d3f823f2ee7671
Instruction ID: 8ebd4f62066da6bc1e6eece94bca2aad79e0aeaeee1dafa0794257788d8c22a6
Opcode Fuzzy Hash: 2ce9c1107f0c934e22e64900501b8baf96be11492b81056775d3f823f2ee7671
Instruction Fuzzy Hash: 1921F371940118BFDB14ABB8EC85DFFB7BCEF45760F14812AF925972E1DB350A0A9620

Function 00A41B21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00A41B40
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A41B66
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00A41B96
InternetCloseHandle.WININET(00000000), ref: 00A41BDD

Part of subcall function 00A42777: GetLastError.KERNEL32(?,?,00A41B0B,00000000,00000000,00000001), ref: 00A4278C
Part of subcall function 00A42777: SetEvent.KERNEL32(?,?,00A41B0B,00000000,00000000,00000001), ref: 00A427A1

Strings

, xrefs: 00A41B87

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 4b2de043633cb25a9032bbee97923328ba5f0e971d6f9d90c5ac5326d2551b37
Instruction ID: 315436fbdeac689afacc0bc6467dd0a198601759baddb5a2e364bdf925d14213
Opcode Fuzzy Hash: 4b2de043633cb25a9032bbee97923328ba5f0e971d6f9d90c5ac5326d2551b37
Instruction Fuzzy Hash: AF218BB9600308BFEB119F609D85EBB76ECEB89748F10452AF505A6240EB349D469761

Function 00A56656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 009D1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 009D1D73
Part of subcall function 009D1D35: GetStockObject.GDI32(00000011), ref: 009D1D87
Part of subcall function 009D1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 009D1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00A566D0
LoadLibraryW.KERNEL32(?), ref: 00A566D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00A566EC
DestroyWindow.USER32(?), ref: 00A566F4

Strings

SysAnimate32, xrefs: 00A566AB

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: a1c806e90866f60947f30dcac726efbf583389f2e5c8fb7e8e08a8e4fb44acb0
Instruction ID: 5c01333ce88986525a0d7f2eb881cbbc071795eaf72ca4b6a1256da51cf3d4a2
Opcode Fuzzy Hash: a1c806e90866f60947f30dcac726efbf583389f2e5c8fb7e8e08a8e4fb44acb0
Instruction Fuzzy Hash: 3321BB71200206BFEF108FA4EC80EAB77ADFB5932AF904629FD1093190D771CC459B60

Function 00A3703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00A3705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00A37091
GetStdHandle.KERNEL32(0000000C), ref: 00A370A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00A370DD

Strings

nul, xrefs: 00A370D8

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: b29392eec9ee8145b9d63a2b8f885b8b35c24d469724e3c3c7f7382e3d72760a
Instruction ID: 5dfc5cefd97854ff68f5ad46617a8b8440447641c9e50629fcf77055a461e0dd
Opcode Fuzzy Hash: b29392eec9ee8145b9d63a2b8f885b8b35c24d469724e3c3c7f7382e3d72760a
Instruction Fuzzy Hash: A4215EB4504309AFDB349F68DC05A9E77B8BF56721F208A29FDA1D72D0E77098518B50

Function 00A3710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00A3712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00A3715D
GetStdHandle.KERNEL32(000000F6), ref: 00A3716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00A371A8

Strings

nul, xrefs: 00A371A3

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 1d32999c47c60f9b83f6220dca9a88200ac074a796af59ed3fe6f155613b07aa
Instruction ID: 41cfb2c0b1ecb493d34e383afb9fe74dc515a5fa6a55d300c060d3afbd5d914f
Opcode Fuzzy Hash: 1d32999c47c60f9b83f6220dca9a88200ac074a796af59ed3fe6f155613b07aa
Instruction Fuzzy Hash: 6B2141B6504319ABDB309F689C04A9EB7E8BF55720F204B19FDA1D72E0DB7098418B51

Function 00A3AEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A3AEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00A3AF13
__swprintf.LIBCMT ref: 00A3AF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,00A5F910), ref: 00A3AF6A

Strings

%lu, xrefs: 00A3AF26

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: c7ffae2a428969591aaf7df21ce630929d3d78dfc92606b8f0f8361c6819d56f
Instruction ID: dae23ad8975fc55c74b621d69e1643dd4441bb689267554a1c96edf5311c2725
Opcode Fuzzy Hash: c7ffae2a428969591aaf7df21ce630929d3d78dfc92606b8f0f8361c6819d56f
Instruction Fuzzy Hash: BD214430A40209AFDB10EF64D985EAE77B8FF89704B10806AF909DB351DB71EA45CB61

Function 00A2A52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D7D2C: _memmove.LIBCMT ref: 009D7D66

Part of subcall function 00A2A37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00A2A399
Part of subcall function 00A2A37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A2A3AC
Part of subcall function 00A2A37C: GetCurrentThreadId.KERNEL32 ref: 00A2A3B3
Part of subcall function 00A2A37C: AttachThreadInput.USER32(00000000), ref: 00A2A3BA

GetFocus.USER32 ref: 00A2A554

Part of subcall function 00A2A3C5: GetParent.USER32(?), ref: 00A2A3D3

GetClassNameW.USER32(?,?,00000100), ref: 00A2A59D
EnumChildWindows.USER32(?,00A2A615), ref: 00A2A5C5
__swprintf.LIBCMT ref: 00A2A5DF

Strings

%s%d, xrefs: 00A2A5D9

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 05273bbfd13496dc4e727158320ee931357dc0cea74b83620f128de55e985eba
Instruction ID: 159a9a89e7f4d0eb21cbeb7f3adb54a60f7c673675a5e5959a679b4b107f02cf
Opcode Fuzzy Hash: 05273bbfd13496dc4e727158320ee931357dc0cea74b83620f128de55e985eba
Instruction Fuzzy Hash: 4B11DF71200218BBDF10BFA8EC85FEA7779AF98300F0440B6F908AA192DB7059468B31

Function 00A32017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A32048

Strings

APPEND, xrefs: 00A32081
EXISTS, xrefs: 00A32070
REMOVE, xrefs: 00A3204E
KEYS, xrefs: 00A3205F

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 51bd2568823d8c1395a581debe0a0ff9abf7f601b5d776e9ccf16763b8a5faf6
Instruction ID: d491da069d887811df386e3629a819313c4e04340b29a359fe8d872157c2296e
Opcode Fuzzy Hash: 51bd2568823d8c1395a581debe0a0ff9abf7f601b5d776e9ccf16763b8a5faf6
Instruction Fuzzy Hash: FA115B309402098FCF14EFA4D8916FEB7B4FF66304F108569E955A72A2EB326D0ACB50

Function 00A4EE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00A4EF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00A4EF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00A4F07E
CloseHandle.KERNEL32(?), ref: 00A4F0FF

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: de26de6a43ee02e6e85b3a04520355aa365538db31885b7245db3feb75438779
Instruction ID: be5e07abe233afbdf6caa3ca9596427a033eda62985fe14b334a2f6722d51dc4
Opcode Fuzzy Hash: de26de6a43ee02e6e85b3a04520355aa365538db31885b7245db3feb75438779
Instruction Fuzzy Hash: E7815175644311AFD720EF28C946F2AB7E5AFC8720F14881EF59ADB392DB70AC418B51

Function 00A502C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009D7F41: _memmove.LIBCMT ref: 009D7F82

Part of subcall function 00A510A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A50038,?,?), ref: 00A510BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A50388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A503C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00A5040E
RegCloseKey.ADVAPI32(?,?), ref: 00A5043A
RegCloseKey.ADVAPI32(00000000), ref: 00A50447

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 86953662639ac6385c7877af3bb332c939d6c5e1d9469f66cd477d95ad50a932
Instruction ID: 1cd87975a9e610c9748819e34387ad6b070135855e8e18caf50256057434bc65
Opcode Fuzzy Hash: 86953662639ac6385c7877af3bb332c939d6c5e1d9469f66cd477d95ad50a932
Instruction Fuzzy Hash: DC513B31208205AFD704EF64D881F6EB7F8FF84315F44892EB9958B291DB31E909CB52

Function 00A4DBDC Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 009D9997: __itow.LIBCMT ref: 009D99C2
Part of subcall function 009D9997: __swprintf.LIBCMT ref: 009D9A0C

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00A4DC3B
GetProcAddress.KERNEL32(00000000,?), ref: 00A4DCBE
GetProcAddress.KERNEL32(00000000,00000000), ref: 00A4DCDA
GetProcAddress.KERNEL32(00000000,?), ref: 00A4DD1B
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00A4DD35

Part of subcall function 009D5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00A37B20,?,?,00000000), ref: 009D5B8C
Part of subcall function 009D5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00A37B20,?,?,00000000,?,?), ref: 009D5BB0

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: f3c3c1d0caeeb07b226de2a22929d97f3b974307e38f4b619d478913e4c1468f
Instruction ID: b3fc7dfc1885eca8b393881a59d3c8062acd7aeaa2c0d54c2e9a2aeabb471276
Opcode Fuzzy Hash: f3c3c1d0caeeb07b226de2a22929d97f3b974307e38f4b619d478913e4c1468f
Instruction Fuzzy Hash: E2511879A40605DFCB00EFA8C484EADB7F4FF99310B15C06AE959AB321DB34AD45CB91

Function 00A3E7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00A3E88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00A3E8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00A3E8F2

Part of subcall function 009D9997: __itow.LIBCMT ref: 009D99C2
Part of subcall function 009D9997: __swprintf.LIBCMT ref: 009D9A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00A3E917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00A3E91F

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 0888f9df609900a8015516b8969e78b75464ddbc8cae79ad7323eb8aef0e925d
Instruction ID: 7d70af7396eda78a0addd3f370e2d3498887980049d91cba029110cc8850e523
Opcode Fuzzy Hash: 0888f9df609900a8015516b8969e78b75464ddbc8cae79ad7323eb8aef0e925d
Instruction Fuzzy Hash: B5510975A00215EFCB01EF64C981AAEBBF5EF48314B1480A9F849AB361CB31AD51DB50

Function 00A5A2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc57bc44403cc1e3cc366651db059668608632e5724d20ba212a4c39760d52a3
Instruction ID: 31513ce700bfa2e2923095f703a3d017a7759615c433700dd1b866a7e07fb68a
Opcode Fuzzy Hash: cc57bc44403cc1e3cc366651db059668608632e5724d20ba212a4c39760d52a3
Instruction Fuzzy Hash: 7C41D339B00204AFC710DB68CC48FA9BBB4FB29366F144265FC56AB2E1D770AE45DA51

Function 009D2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 009D2357
ScreenToClient.USER32(00A967B0,?), ref: 009D2374
GetAsyncKeyState.USER32(00000001), ref: 009D2399
GetAsyncKeyState.USER32(00000002), ref: 009D23A7

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 64fd1d65e9e12f389e04ed136f2ec945d36451ca0c0bae406dd33052c59321be
Instruction ID: 038247143dd23ffe6f6d5d0fd73fb282224a803d497420ada4a74d15006c3235
Opcode Fuzzy Hash: 64fd1d65e9e12f389e04ed136f2ec945d36451ca0c0bae406dd33052c59321be
Instruction Fuzzy Hash: A1419E31904219FBCF159FA8D844AE9FB74FB19770F20835AF828962E0C7349994DB91

Function 00A26920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A2695D
TranslateAcceleratorW.USER32(?,?,?), ref: 00A269A9
TranslateMessage.USER32(?), ref: 00A269D2
DispatchMessageW.USER32(?), ref: 00A269DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A269EB

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: c1a6a0a0a61896694e940d8c7a9717f729234601062eedf0977fedbe5a30507e
Instruction ID: 59cf89845cd99ba2649cb66b08a90fdc3b55e307cfb6b56be5dabfdbe1ebb3c8
Opcode Fuzzy Hash: c1a6a0a0a61896694e940d8c7a9717f729234601062eedf0977fedbe5a30507e
Instruction Fuzzy Hash: 2D31A371A02266AEDB20CFB8AC84BB67BBCAF01344F144576E421D71A1DF359886D790

Function 00A28F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00A28F12
PostMessageW.USER32(?,00000201,00000001), ref: 00A28FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00A28FC4
PostMessageW.USER32(?,00000202,00000000), ref: 00A28FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00A28FDA

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: b11e65e545f12c8384fbb3ad443a23a24e3d0a1e4f7dc03b869be1fc0a3cc09e
Instruction ID: 107ec18cb38c24ae6d00e990263b45a5c8e64ad8b25b00018485e406451f1934
Opcode Fuzzy Hash: b11e65e545f12c8384fbb3ad443a23a24e3d0a1e4f7dc03b869be1fc0a3cc09e
Instruction Fuzzy Hash: FF31CE71501229EFDB14CFACEA4CA9E7BB6FB04316F108229F925EB1D0C7B49914DB90

Function 00A2B6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00A2B6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00A2B6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00A2B71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00A2B742
_wcsstr.LIBCMT ref: 00A2B74C

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 19db07f8a6257f1035a8b0ffe0381554ce0b8f3711c1d5901ae1b2f0b6ade59f
Instruction ID: 4b2056f0ce7d95b71a03c1a5a942bfe64d524632ef9eaaea9fb2a23d7536b1ef
Opcode Fuzzy Hash: 19db07f8a6257f1035a8b0ffe0381554ce0b8f3711c1d5901ae1b2f0b6ade59f
Instruction Fuzzy Hash: 78210432605254BBEB259B79AC49E7B7BACEF89721F104039FD05CA1A1EF71DC4193A0

Function 00A5B405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 009D2612: GetWindowLongW.USER32(?,000000EB), ref: 009D2623

GetWindowLongW.USER32(?,000000F0), ref: 00A5B44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00A5B471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00A5B489
GetSystemMetrics.USER32(00000004), ref: 00A5B4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00A41184,00000000), ref: 00A5B4D0

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 9c5539eb6f04a60d43af59ecf4089319c646b12959d00ee568957c4a183356e8
Instruction ID: af681f8de6b07da97157d982f2a363e9b87d920e41467666c082d7547d0420dc
Opcode Fuzzy Hash: 9c5539eb6f04a60d43af59ecf4089319c646b12959d00ee568957c4a183356e8
Instruction Fuzzy Hash: A8219171620255AFCB209F788C44A6A37B4FB05723F118739FD26C71E2E7309815DBA0

Function 00A297E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00A29802

Part of subcall function 009D7D2C: _memmove.LIBCMT ref: 009D7D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00A29834
__itow.LIBCMT ref: 00A2984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00A29874
__itow.LIBCMT ref: 00A29885

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: e86e70ee651c49d3e0155a063195e445d2b35e60c600488bf4f60af0a9bcd189
Instruction ID: d94dc48c4ad6dfc373daa29d003966fb3f3c75617a23379b7e571157141926fc
Opcode Fuzzy Hash: e86e70ee651c49d3e0155a063195e445d2b35e60c600488bf4f60af0a9bcd189
Instruction Fuzzy Hash: 0321C571B00258BFDB10ABB99C86EEF7BA9EF4AB10F084035FD04DB291E6709D458791

Function 009D12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009D134D
SelectObject.GDI32(?,00000000), ref: 009D135C
BeginPath.GDI32(?), ref: 009D1373
SelectObject.GDI32(?,00000000), ref: 009D139C

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 2f68a24d10afd5152d872e3119556ffe7ea1435cb33d316c293d59d7cfb456d6
Instruction ID: 7295593f7b49b966a7aa19b0af524c6581b9f914cfcc8b3267890c862487f821
Opcode Fuzzy Hash: 2f68a24d10afd5152d872e3119556ffe7ea1435cb33d316c293d59d7cfb456d6
Instruction Fuzzy Hash: BA213E71940308EFDB11DFA5EC047A9BBB8FF10362F14C227F810962A0DB719996DB90

Function 00A2C161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00A2C176
_memcmp.LIBCMT ref: 00A2C194
_memcmp.LIBCMT ref: 00A2C1A7
_memcmp.LIBCMT ref: 00A2C1BF
_memcmp.LIBCMT ref: 00A2C1D7

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: b3c70ccba4bbbbdae1e9b5a6e613558d57df2827b56c35a7fb56d2547697054b
Instruction ID: 45156c555be503ec0660e49405c55fe79d74ba9d67b45e52fff6d2ccff1aee41
Opcode Fuzzy Hash: b3c70ccba4bbbbdae1e9b5a6e613558d57df2827b56c35a7fb56d2547697054b
Instruction Fuzzy Hash: 4A0175B1604529BBE204A6296C43FBFB76CAF613B8F444635FE04D6283E651DF2183E1

Function 00A34D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A34D5C
__beginthreadex.LIBCMT ref: 00A34D7A
MessageBoxW.USER32(?,?,?,?), ref: 00A34D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00A34DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00A34DAC

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 6245b28b3802183512077efedca17aaf8bd9a788f420367fef5983fe5a419a51
Instruction ID: 632d68e00835809d8fda1b8aae84aa887148acc891b85f98d0fbb8ac77a0177f
Opcode Fuzzy Hash: 6245b28b3802183512077efedca17aaf8bd9a788f420367fef5983fe5a419a51
Instruction Fuzzy Hash: 3611E1B2E04248BFC701DBF89C08AEB7BACFB49321F144366FA14D3260DA718D0187A0

Function 00A2874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A28766
GetLastError.KERNEL32(?,00A2822A,?,?,?), ref: 00A28770
GetProcessHeap.KERNEL32(00000008,?,?,00A2822A,?,?,?), ref: 00A2877F
HeapAlloc.KERNEL32(00000000,?,00A2822A,?,?,?), ref: 00A28786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A2879D

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 381fd5fb5b694fca5e1f550278070631eb5ec6864c42732dd940fc73972aa80c
Instruction ID: eecc337eb12da05a56c3351c8c98e74b758c4627fdb66fd61c92242874653a75
Opcode Fuzzy Hash: 381fd5fb5b694fca5e1f550278070631eb5ec6864c42732dd940fc73972aa80c
Instruction Fuzzy Hash: 88014B71202214EFDB248FAAEC88D6B7BACFF893567200579F949C3260DA318C11CA60

Function 00A354E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A35502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00A35510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A35518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00A35522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A3555E

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: cbdd6efa6a774228306ee2a2a1180f33f149ac44dd9173af498165a0ebdc3ae3
Instruction ID: 016d4dbb5545528edb239af9d45d2a72c8fb738b2f93783a6ede7126da41b0f4
Opcode Fuzzy Hash: cbdd6efa6a774228306ee2a2a1180f33f149ac44dd9173af498165a0ebdc3ae3
Instruction Fuzzy Hash: C9011736D01A29DBCF00EFF9E888AEDBB79BB09712F010556E906B2140DB31A655C7A1

Function 00A27652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00A2758C,80070057,?,?,?,00A2799D), ref: 00A2766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00A2758C,80070057,?,?), ref: 00A2768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00A2758C,80070057,?,?), ref: 00A27698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00A2758C,80070057,?), ref: 00A276A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00A2758C,80070057,?,?), ref: 00A276B4

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 3d5e658ba8f1b8c5d86f4d8e845f707ca6e86915912172f624c6740cdf7b2b00
Instruction ID: 8c6c6df166700b996bd60cc3868b74047e82f0ca7d9ec1981596128508b12320
Opcode Fuzzy Hash: 3d5e658ba8f1b8c5d86f4d8e845f707ca6e86915912172f624c6740cdf7b2b00
Instruction Fuzzy Hash: D3017172601724AFDB119F5DEC44AAE7BAEFB44752F140038FD04D2211E731DE4297A0

Function 00A285F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00A28608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00A28612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00A28621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00A28628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00A2863E

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: aa034e17ddfa23833c0d7a1d8f60f64405715810b09f8470a7bf99924bbf19f7
Instruction ID: 524aeabca267bd8512767e2a0e254647da0ee01100d7982dce971e651b8f5d34
Opcode Fuzzy Hash: aa034e17ddfa23833c0d7a1d8f60f64405715810b09f8470a7bf99924bbf19f7
Instruction Fuzzy Hash: C3F04F35202315AFEB204FE9EC8DE6B3BACFF89B55B040535F945C6190EB759C42DA60

Function 00A28652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00A28669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00A28673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A28682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00A28689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A2869F

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 6e2f3c6d208081cb0649eb2de3738aeceaee01c7520a21b32ef7071eee6bfdba
Instruction ID: 75883ddfe1503fe18d29643ec0d214e4edf6e7a873e9599190d88e549a372c15
Opcode Fuzzy Hash: 6e2f3c6d208081cb0649eb2de3738aeceaee01c7520a21b32ef7071eee6bfdba
Instruction Fuzzy Hash: ABF0AF70202314AFEB115FA8EC88E6B3BADFF89756B140035F905C6190DA709802EA60

Function 00A2C6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00A2C6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 00A2C6D1
MessageBeep.USER32(00000000), ref: 00A2C6E9
KillTimer.USER32(?,0000040A), ref: 00A2C705
EndDialog.USER32(?,00000001), ref: 00A2C71F

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: d9cae0458e3b59379f4056bd7987598ac49b9badb321bcda7672e0957b7d844f
Instruction ID: 9e3fec4d1e14bc0c0ecc1be07abe4301af8caff6a191b41f55879b2f971e4437
Opcode Fuzzy Hash: d9cae0458e3b59379f4056bd7987598ac49b9badb321bcda7672e0957b7d844f
Instruction Fuzzy Hash: F2018630500714ABEB21AB64ED5EF9A77B8FF04716F000679F542A18E1EBF0A9558F81

Function 009D13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 009D13BF
StrokeAndFillPath.GDI32(?,?,00A0BAD8,00000000,?), ref: 009D13DB
SelectObject.GDI32(?,00000000), ref: 009D13EE
DeleteObject.GDI32 ref: 009D1401
StrokePath.GDI32(?), ref: 009D141C

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: e8ccdb6aaf4e5f6627494cb5c0b27e07219be2cc00698a8a747e42eb687cd96d
Instruction ID: 554a77d470ad01cc95adaff868d6f372f15a6076ff6483daaa9ecda609fd6d8a
Opcode Fuzzy Hash: e8ccdb6aaf4e5f6627494cb5c0b27e07219be2cc00698a8a747e42eb687cd96d
Instruction Fuzzy Hash: 02F0C431144708EFDB15DFA6EC0C7587BA8BB01326F08C226E429851F1DB358997DF50

Function 00A3C602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00A3C69D
CoCreateInstance.OLE32(00A62D6C,00000000,00000001,00A62BDC,?), ref: 00A3C6B5

Part of subcall function 009D7F41: _memmove.LIBCMT ref: 009D7F82

CoUninitialize.OLE32 ref: 00A3C922

Strings

.lnk, xrefs: 00A3C631, 00A3C659, 00A3C663

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 70cfc958a3b9fb78082f940de7802c60b458923d3708fc559c010494c3882836
Instruction ID: ed722f155360d101c91b958644cacf4cc38423ae340566dbe1cdf4cf695ed9af
Opcode Fuzzy Hash: 70cfc958a3b9fb78082f940de7802c60b458923d3708fc559c010494c3882836
Instruction Fuzzy Hash: C4A12A71148205AFD700EF64C881FABB7E8FF94754F00896DF156972A2EB70EA49CB52

Function 009E2E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 009F0FF6: std::exception::exception.LIBCMT ref: 009F102C
Part of subcall function 009F0FF6: __CxxThrowException@8.LIBCMT ref: 009F1041

Part of subcall function 009D7F41: _memmove.LIBCMT ref: 009D7F82

Part of subcall function 009D7BB1: _memmove.LIBCMT ref: 009D7C0B

__swprintf.LIBCMT ref: 009E302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 009E2EC6

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 72f94d8d3850f5ce027e1df0ea72791d000a8f3054ec97022bcd1fda7b8d45e7
Instruction ID: de342bc58813c4691d26ee464dd9c31876877fe5db6b4fbdd4d8e3972b9b9370
Opcode Fuzzy Hash: 72f94d8d3850f5ce027e1df0ea72791d000a8f3054ec97022bcd1fda7b8d45e7
Instruction Fuzzy Hash: BD918F71108745AFC719EF24D885E6EB7B8EF85740F04891EF486972A1EB30EE45CB52

Function 00A3BBA6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 009D48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009D48A1,?,?,009D37C0,?), ref: 009D48CE

CoInitialize.OLE32(00000000), ref: 00A3BC26
CoCreateInstance.OLE32(00A62D6C,00000000,00000001,00A62BDC,?), ref: 00A3BC3F
CoUninitialize.OLE32 ref: 00A3BC5C

Part of subcall function 009D9997: __itow.LIBCMT ref: 009D99C2
Part of subcall function 009D9997: __swprintf.LIBCMT ref: 009D9A0C

Strings

.lnk, xrefs: 00A3BC08, 00A3BC16

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 7051a04f832fdc32e4c334eb74f307a02622ce222dd675cac621d31b15bc9cbe
Instruction ID: 316ec0feb9b6563a206b3b60106c8ce27449ef44aea5f507c02195a57e570593
Opcode Fuzzy Hash: 7051a04f832fdc32e4c334eb74f307a02622ce222dd675cac621d31b15bc9cbe
Instruction Fuzzy Hash: 6CA15775604301AFCB10EF18C494E5ABBE6FF88314F148999F9999B3A1CB31ED45CB91

Function 009F524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 009F52DD

Part of subcall function 00A00340: __87except.LIBCMT ref: 00A0037B

Strings

pow, xrefs: 009F52B5, 009F52D2

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 6b3c5b5b9c415b776e9602c43e5c21c6aca8b856245acd8dc7abbbc1f16897e1
Instruction ID: c797055f5a5c735ae9215c555832487719f918411ea81f53bee10552e751e93f
Opcode Fuzzy Hash: 6b3c5b5b9c415b776e9602c43e5c21c6aca8b856245acd8dc7abbbc1f16897e1
Instruction Fuzzy Hash: 70519E21E1CA0DC7CB11B718E901B7E2BA89B00350F218E59E3D5861E9EFB58CD5DB46

Function 009F023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 009F0280
+, xrefs: 009F0277

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 0ee403f478e2817ff15cf4858daf0dfdc50838c824e3e8e84b757da06b1762fe
Instruction ID: f7251952cb059d11640c1604012147fd48c83c74f3306626acaead20b74ca5a3
Opcode Fuzzy Hash: 0ee403f478e2817ff15cf4858daf0dfdc50838c824e3e8e84b757da06b1762fe
Instruction Fuzzy Hash: D851213590426A8FDF15DF7CE8886FA7BA8FF99310F144066EC919B2A1D7349C42C760

Function 009E62F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009E63A8
_memmove.LIBCMT ref: 009E6446
_memset.LIBCMT ref: 009E646A

Strings

ERCP, xrefs: 009E6313

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 475d3f78cb4098043a286e8448b6de0e6b8c8bd27dd5b37a8545f224aa468388
Instruction ID: fa5c6ce68f84d8b3b125abc5c91e1abff6fb495f1d32808cc364bef69953c047
Opcode Fuzzy Hash: 475d3f78cb4098043a286e8448b6de0e6b8c8bd27dd5b37a8545f224aa468388
Instruction Fuzzy Hash: 2651E271900359DBCB25CF66C8807AABBF8EF14354F20856EE64AC7291F770E990CB50

Function 00A57BB5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00A5F910,00000000,?,?,?,?), ref: 00A57C4E
GetWindowLongW.USER32 ref: 00A57C6B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A57C7B

Strings

SysTreeView32, xrefs: 00A57C20

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: c75f7b8486dbf8b52c53fba5e480d4892f5b3f769d97965e7b46d002f41fe1f7
Instruction ID: a58992d20120a66ff7eb377b9c8f201622dcc8d645e7ae1b18fb3c88cf6c6589
Opcode Fuzzy Hash: c75f7b8486dbf8b52c53fba5e480d4892f5b3f769d97965e7b46d002f41fe1f7
Instruction Fuzzy Hash: 3131CD31244206AEDB118F78EC45BEA77A9FF45325F204725FC76A32E0D731E8558B60

Function 00A57648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00A576D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00A576E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 00A57708

Strings

SysMonthCal32, xrefs: 00A5769B

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 608c792fb9a576ecb2376b6d6ae0eda437db8e3c58b75f387540f5f64efb1c28
Instruction ID: f76b98d9f17d668ab0aa86c42131b8a9c1b79cd8ed00d6e43586e49dd9323839
Opcode Fuzzy Hash: 608c792fb9a576ecb2376b6d6ae0eda437db8e3c58b75f387540f5f64efb1c28
Instruction Fuzzy Hash: 98218B32610219BBDF11CFA4DC46FEE3BA9FB48725F110214FE15BB1D0DAB1A8559BA0

Function 00A56F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00A56FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00A56FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00A56FDF

Strings

Listbox, xrefs: 00A56F77

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: a47661a13e48012a2f096d30a731335e883129ffcb7804764a3c47a56d80b1f2
Instruction ID: 74262652782e331c59911524e74ffc1123304c3482317cd457858cb76e0ece6e
Opcode Fuzzy Hash: a47661a13e48012a2f096d30a731335e883129ffcb7804764a3c47a56d80b1f2
Instruction Fuzzy Hash: B421A732A10118BFDF118F54DC85FAB37BAFF89755F418124F9149B190C671AC59CBA0

Function 00A5797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00A579E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00A579F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00A57A03

Strings

msctls_trackbar32, xrefs: 00A579B8

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 612d4d17232d8149dbc7c1196dd2f226aa54be28bdaf38d822fb732fdd19c586
Instruction ID: e06b6170175f9c604e7fa12143c2af932246064242ce5d45a67930288583b427
Opcode Fuzzy Hash: 612d4d17232d8149dbc7c1196dd2f226aa54be28bdaf38d822fb732fdd19c586
Instruction Fuzzy Hash: 0911E332254208BEEF109FB0DC05FAF3BA9FF89B65F014519FB41A6090D771A811CB60

Function 009D4C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,009D4C2E), ref: 009D4CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 009D4CB5

Strings

kernel32.dll, xrefs: 009D4C9E
GetNativeSystemInfo, xrefs: 009D4CAF

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 03b93d470c7eb58645235f0c84ba28f986531f08d5a13695861e33c311213a86
Instruction ID: a5903a6a19ce5b1978a8f99fd2e08519a0eb0375befb5ff4a89afc73eea249e5
Opcode Fuzzy Hash: 03b93d470c7eb58645235f0c84ba28f986531f08d5a13695861e33c311213a86
Instruction Fuzzy Hash: 6CD01770560B23DFDB209F71DA18A4676E9BF05792B12CC3A98C6D6250E670D880CA51

Function 009D4D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,009D4CE1,?), ref: 009D4DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 009D4DB4

Strings

kernel32.dll, xrefs: 009D4D9D
Wow64RevertWow64FsRedirection, xrefs: 009D4DAE

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 49388042e4f9998acc51f914d2b20e1ad6d33d9ac0e424b50fcb7bc99990bf98
Instruction ID: e7d54f8848ef9e32901d57c25811f1d331c8c66a3f16e3aabefd5be0fd2cf655
Opcode Fuzzy Hash: 49388042e4f9998acc51f914d2b20e1ad6d33d9ac0e424b50fcb7bc99990bf98
Instruction Fuzzy Hash: EBD01771590B13DFDB20AF71D808A4A76E9BF05356B21CC3AD8D6DA290E770E880CA50

Function 009D4D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,009D4D2E,?,009D4F4F,?,00A962F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 009D4D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 009D4D81

Strings

Wow64DisableWow64FsRedirection, xrefs: 009D4D7B
kernel32.dll, xrefs: 009D4D6A

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: cbf0f2c3ae87d6f1818aeb20c3de395fee96d661ad2cad66f9c08cbf1eabab97
Instruction ID: f196720a1ab2207c4230e0f97eadc62eb5aca56a5e6d4fc9f3d096faa0b352c6
Opcode Fuzzy Hash: cbf0f2c3ae87d6f1818aeb20c3de395fee96d661ad2cad66f9c08cbf1eabab97
Instruction Fuzzy Hash: CCD01770950B13DFDB20AF71D80861676E9BF15352B21CD3A9896D6290E670E880CA61

Function 00A51072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00A512C1), ref: 00A51080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00A51092

Strings

RegDeleteKeyExW, xrefs: 00A5108C
advapi32.dll, xrefs: 00A5107B

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 1009bb19b317561d51b2eb879d3d50d26a22f58808f8637178980fb50da17740
Instruction ID: a75bfefc597c138a1a60cf40c81c64843f8c5669471787925609903e5cbf87e1
Opcode Fuzzy Hash: 1009bb19b317561d51b2eb879d3d50d26a22f58808f8637178980fb50da17740
Instruction Fuzzy Hash: B8D01270510712DFD720AF75D85866676E4BF05392B118D3AA8C5D7190F770C8C0C750

Function 00A493F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00A49009,?,00A5F910), ref: 00A49403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00A49415

Strings

kernel32.dll, xrefs: 00A493FE
GetModuleHandleExW, xrefs: 00A4940F

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: f4a0c5bc2e09d80888f8dcda551c444f4e6cb16e480eca513133104bd0029e21
Instruction ID: b7e91b4ad0c8fac6c97e55f2d2cf0cc9726514f201662802a5e6ce8674405701
Opcode Fuzzy Hash: f4a0c5bc2e09d80888f8dcda551c444f4e6cb16e480eca513133104bd0029e21
Instruction Fuzzy Hash: E6D0C778540B13DFDB20AFB1CA0D60372E4BF00342B01CC3AA882C2550EB70C880CB50

Function 00A11B3E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00A11B42
__swprintf.LIBCMT ref: 00A11B73

Strings

WIN_XPe, xrefs: 00A11BB2
%.3d, xrefs: 00A11B4D

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: c11aaa3c5a26b4987148dfc6424633df874b3545a6a6fefe80aee557466aa453
Instruction ID: 461fbb1b090fd9df34679f191d31b720ec69521e2cb6026319eff3dc68b9c2c7
Opcode Fuzzy Hash: c11aaa3c5a26b4987148dfc6424633df874b3545a6a6fefe80aee557466aa453
Instruction Fuzzy Hash: 13D017B1C0C21CEACB04AA909C849FA737CBB18301F544993FA06E2500F3389BD5EB25

Function 00A276C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eadc96a763d98b37edd15d9bc82aed21c8e28d3dbb68b6aafb23ce54cfedae8
Instruction ID: aec7b56a4021bbf8ba282cb955432deb12a75e53bc12c95b9bc52d35c7237c3c
Opcode Fuzzy Hash: 3eadc96a763d98b37edd15d9bc82aed21c8e28d3dbb68b6aafb23ce54cfedae8
Instruction Fuzzy Hash: CAC16175A04226EFCB14CF98D884EAEB7F5FF48714B1585A9E805EB251D730EE81CB90

Function 00A4E33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00A4E3D2
CharLowerBuffW.USER32(?,?), ref: 00A4E415

Part of subcall function 00A4DAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00A4DAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00A4E615
_memmove.LIBCMT ref: 00A4E628

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 13ec8113a40d677ac8d8416ca66384cd2bfee675614e28a3cd9eaa041b7365c3
Instruction ID: f9537bff8a162eb605ee33fd74b288f331e3999f750fe8ed647bbdca9b771d99
Opcode Fuzzy Hash: 13ec8113a40d677ac8d8416ca66384cd2bfee675614e28a3cd9eaa041b7365c3
Instruction Fuzzy Hash: 54C149756083119FC714DF28C480A6ABBF4FF88714F14896EF99A9B351D731E946CB82

Function 00A483A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00A483D8
CoUninitialize.OLE32 ref: 00A483E3

Part of subcall function 00A2DA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00A2DAC5

VariantInit.OLEAUT32(?), ref: 00A483EE
VariantClear.OLEAUT32(?), ref: 00A486BF

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: d930338f018bbd8ee90c290190c8cf9e8fdb627b9198e5792e7548fba5b7c647
Instruction ID: f622d5bef77f8bcbebd5b0809de7f1d71387cbf6907238ec60acdad044cf29bd
Opcode Fuzzy Hash: d930338f018bbd8ee90c290190c8cf9e8fdb627b9198e5792e7548fba5b7c647
Instruction Fuzzy Hash: CCA12A792447119FCB10EF18D891B2EB7E4BF88314F158459F99A9B3A1CB34ED44CB46

Function 00A27A78 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00A62C7C,?), ref: 00A27C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00A62C7C,?), ref: 00A27C4A
CLSIDFromProgID.OLE32(?,?,00000000,00A5FB80,000000FF,?,00000000,00000800,00000000,?,00A62C7C,?), ref: 00A27C6F
_memcmp.LIBCMT ref: 00A27C90

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 043be23c861a603623294dfba0af33a3c75ee48f8128314b60399e5038e7f816
Instruction ID: 1cada8d2d5bd4ca6a21e8cff176d994022385c00b4b66905b9906c5b259c1734
Opcode Fuzzy Hash: 043be23c861a603623294dfba0af33a3c75ee48f8128314b60399e5038e7f816
Instruction Fuzzy Hash: 07810D71A00119EFCB04DF98D984EEEB7B9FF89315F2045A9F506AB250DB71AE05CB60

Function 00A26DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A26E04
SysAllocString.OLEAUT32(00000000), ref: 00A26EAD
VariantCopy.OLEAUT32 ref: 00A26EDC
VariantClear.OLEAUT32(?), ref: 00A26F03

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 1d44ac88b03a552206ecbbf9c7254cf5136006cd4a5bef0de58766e3e4aead2f
Instruction ID: 803877bae1ad05b8f5d56015d28c66aadb2d580b3c84589dbfca39a21343f798
Opcode Fuzzy Hash: 1d44ac88b03a552206ecbbf9c7254cf5136006cd4a5bef0de58766e3e4aead2f
Instruction Fuzzy Hash: 1F5183316483119ADB34AF6DF895B7EB3F9AF48310F20883FE596CB291DB7099449B11

Function 00A59A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(0139E838,?), ref: 00A59AD2
ScreenToClient.USER32(00000002,00000002), ref: 00A59B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00A59B72

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 03d291b61b0dc7309cba0f5e60392a35a0c9c2c850a9d9d6c9e45213e113c2e5
Instruction ID: f707411e317bf7d8b5e7dda856d41dc2a047d3e82ef229dfe248c3b45b4c50d9
Opcode Fuzzy Hash: 03d291b61b0dc7309cba0f5e60392a35a0c9c2c850a9d9d6c9e45213e113c2e5
Instruction Fuzzy Hash: 09512D34A00209EFDF10DF68D980AAE7BB6FF54361F158159FD159B290D730AD45CB90

Function 00A46CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00A46CE4
WSAGetLastError.WSOCK32(00000000), ref: 00A46CF4

Part of subcall function 009D9997: __itow.LIBCMT ref: 009D99C2
Part of subcall function 009D9997: __swprintf.LIBCMT ref: 009D9A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00A46D58
WSAGetLastError.WSOCK32(00000000), ref: 00A46D64

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 2946e1f953280fc12cfcb443c3b65cc7cbe20e594eef4e5d457b1a451721a1e1
Instruction ID: d926bd113bef7936069cf05fb356204b2c7cee3daa72c7c2d290b155d3cb178f
Opcode Fuzzy Hash: 2946e1f953280fc12cfcb443c3b65cc7cbe20e594eef4e5d457b1a451721a1e1
Instruction Fuzzy Hash: C7418175780210AFEB10BF28DC86F7A77A5AB84B14F44C019FA59AB3D3DB719D018B91

Function 00A4672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00A5F910), ref: 00A467BA
_strlen.LIBCMT ref: 00A467EC

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: e6cbb79216bf875dbd1f7c3eab7ba95bcb9de6846df0e010037190e00ca05451
Instruction ID: df81c277beac6edcd5600eb44d980b8a3352abd43b91745ce4097af3f8c6fb79
Opcode Fuzzy Hash: e6cbb79216bf875dbd1f7c3eab7ba95bcb9de6846df0e010037190e00ca05451
Instruction Fuzzy Hash: A041A235A00104AFCB14FBA8DDC1FAEB3A9AF85310F148166F81997292DB30AD01C751

Function 00A3BA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00A3BB09
GetLastError.KERNEL32(?,00000000), ref: 00A3BB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00A3BB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00A3BB80

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 92baa1078150014ec20566abb5cb25ca17bdab8b51bddf2c512290eeca0ceda2
Instruction ID: f74037ae2737c7a01c3296f8c85bdd5b283cc99b34a7cf30d263395c942c301d
Opcode Fuzzy Hash: 92baa1078150014ec20566abb5cb25ca17bdab8b51bddf2c512290eeca0ceda2
Instruction Fuzzy Hash: 09411639600A10EFCB10EF19C594A5DBBE2AF89310F09D499F94A9B362CB34FD01CB91

Function 00A58AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00A58B4D

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 3c0d915c8c1c4096f670300dcf88fac72e9f9533cf4cf33f016d36cffb541e49
Instruction ID: 021e225e7e489fce080d16d3cf1c6017c1a91ab3964c9b2280a40431f70d7cb2
Opcode Fuzzy Hash: 3c0d915c8c1c4096f670300dcf88fac72e9f9533cf4cf33f016d36cffb541e49
Instruction Fuzzy Hash: 5031D4B4601204BFEF209B58CC85FAD37A8FB05352F258612FE51F62A0DE38A9488651

Function 00A5ADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00A5AE1A
GetWindowRect.USER32(?,?), ref: 00A5AE90
PtInRect.USER32(?,?,00A5C304), ref: 00A5AEA0
MessageBeep.USER32(00000000), ref: 00A5AF11

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: a71671fed3cb409af694bb6d8c688ceb428d7bd1639f51bab56bd05692a0856b
Instruction ID: aed1db7af48c302d178bafb2694ef8a50544288780669822cc5ae6c73e0273b0
Opcode Fuzzy Hash: a71671fed3cb409af694bb6d8c688ceb428d7bd1639f51bab56bd05692a0856b
Instruction Fuzzy Hash: 61418E70700229DFCB11CF98D885A697BF5FF69742F1482A9EC159B251D730A90ACF92

Function 00A30FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00A31037
SetKeyboardState.USER32(00000080,?,00000001), ref: 00A31053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00A310B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00A3110B

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: c294d117dc45ef86f99fde6ffe62ac86e94442587e97cba15be9e08a755dccdc
Instruction ID: 9183e0cc438d556ac5bb18a1cc059dd43804790adbc5dd23badd21c2aab2bb74
Opcode Fuzzy Hash: c294d117dc45ef86f99fde6ffe62ac86e94442587e97cba15be9e08a755dccdc
Instruction Fuzzy Hash: 7C314430E40688AEFF38CB698C05BFABBB9AB4A311F08432AF580561D1C37489D19761

Function 00A31121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00A31176
SetKeyboardState.USER32(00000080,?,00008000), ref: 00A31192
PostMessageW.USER32(00000000,00000101,00000000), ref: 00A311F1
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00A31243

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: dcacfc2d5f1bc2388ba1dd2e7414a63d9973eb6405d507c3c0240fe9c49352e5
Instruction ID: 02da357722ec4e5eee397c92465223c24f9eefba370f7f0e6f45b7b8dcac383b
Opcode Fuzzy Hash: dcacfc2d5f1bc2388ba1dd2e7414a63d9973eb6405d507c3c0240fe9c49352e5
Instruction Fuzzy Hash: 7331F630A407186EEF31CBA58C15BFABBBAAB49310F04436FF591921D1D3748A9597A1

Function 00A06415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00A0644B
__isleadbyte_l.LIBCMT ref: 00A06479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00A064A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00A064DD

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 9467c84188818735f33edb631090c94f7b56a1ddedba3f551a395c330f109eb5
Instruction ID: f6815070deacbd852849bf29f799f010814fcc5d767ba5117208c1cc64812ce1
Opcode Fuzzy Hash: 9467c84188818735f33edb631090c94f7b56a1ddedba3f551a395c330f109eb5
Instruction Fuzzy Hash: 6031BE3160025AAFDB218F65EE85BBA7BB5FF40328F154129E854871E1EB32D861DB90

Function 00A55175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00A55189

Part of subcall function 00A3387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00A33897
Part of subcall function 00A3387D: GetCurrentThreadId.KERNEL32 ref: 00A3389E
Part of subcall function 00A3387D: AttachThreadInput.USER32(00000000,?,00A352A7), ref: 00A338A5

GetCaretPos.USER32(?), ref: 00A5519A
ClientToScreen.USER32(00000000,?), ref: 00A551D5
GetForegroundWindow.USER32 ref: 00A551DB

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 0be2032bae647cf1a4a4063e88764d5f7e48b70c8d5413b0995e3b098c6ee84b
Instruction ID: 5dfe88eeb35aa1dea46fdbc214154250805253c03d978dc6f824c3eeb100cc39
Opcode Fuzzy Hash: 0be2032bae647cf1a4a4063e88764d5f7e48b70c8d5413b0995e3b098c6ee84b
Instruction Fuzzy Hash: D2310F72D00118AFDB00EFB5D985AEFB7F9EF98304F10806AE415E7251EA759E05CBA0

Function 00A5C788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D2612: GetWindowLongW.USER32(?,000000EB), ref: 009D2623

GetCursorPos.USER32(?), ref: 00A5C7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00A0BBFB,?,?,?,?,?), ref: 00A5C7D7
GetCursorPos.USER32(?), ref: 00A5C824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00A0BBFB,?,?,?), ref: 00A5C85E

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 52f23d0aa20900c03c72c110da8181f95ef223fbcb39f5468f73eb0384820314
Instruction ID: 08404fe222c84057ada0607188e2c45670e6f5a8d1ffd38b740e18e3824f10c3
Opcode Fuzzy Hash: 52f23d0aa20900c03c72c110da8181f95ef223fbcb39f5468f73eb0384820314
Instruction Fuzzy Hash: 7A318035600218AFCB15CFA8C898EEA7BB6FF49321F04406AFD058B265D7319D55DFA0

Function 00A28B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A28652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00A28669
Part of subcall function 00A28652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00A28673
Part of subcall function 00A28652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A28682
Part of subcall function 00A28652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00A28689
Part of subcall function 00A28652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A2869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00A28BEB
_memcmp.LIBCMT ref: 00A28C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A28C44
HeapFree.KERNEL32(00000000), ref: 00A28C4B

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 55aba171beeda4ce2b8c87143c372b93725a2afd4139c868c012ae93f0cc073e
Instruction ID: d48198579bb076b7343ceee74f85bd4bbf542888a1913612a57aba027ad44d2c
Opcode Fuzzy Hash: 55aba171beeda4ce2b8c87143c372b93725a2afd4139c868c012ae93f0cc073e
Instruction Fuzzy Hash: 47216B71E02218EFDB10DFA8D945BAEB7B8FF44355F144069F554A7240DB39AA06CB60

Function 009F0BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 009F0BF2

Part of subcall function 009D5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00A37B20,?,?,00000000), ref: 009D5B8C
Part of subcall function 009D5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00A37B20,?,?,00000000,?,?), ref: 009D5BB0

_fprintf.LIBCMT ref: 009F0C29
OutputDebugStringW.KERNEL32(?), ref: 00A26331

Part of subcall function 009F4CDA: _flsall.LIBCMT ref: 009F4CF3

__setmode.LIBCMT ref: 009F0C5E

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: d83bc9d1f209bb2d49efca286c8de6eff705e959edb2d9864842680f574f4476
Instruction ID: 6af6e5465e76003ac6e8827088e5e306a71bd03c7c61d54d9097cfb11bf84629
Opcode Fuzzy Hash: d83bc9d1f209bb2d49efca286c8de6eff705e959edb2d9864842680f574f4476
Instruction Fuzzy Hash: 2B110632A0420CBBDB04B7B8AC47BBF7B6D9FC1320F24411AF34497292DE655D869795

Function 00A41A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00A41A97

Part of subcall function 00A41B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00A41B40
Part of subcall function 00A41B21: InternetCloseHandle.WININET(00000000), ref: 00A41BDD

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: b65ee2a36cc0db7d2bdeb329bdf41cd899f14f125a57e2dbf10823138e7a2513
Instruction ID: 31040855a00c4cd6fc027f1e7c255c1ac866ed9d3474c099c079c7fdc0e20874
Opcode Fuzzy Hash: b65ee2a36cc0db7d2bdeb329bdf41cd899f14f125a57e2dbf10823138e7a2513
Instruction Fuzzy Hash: 0A219239200601BFDB119F608C01FBABBA9FFC8741F10401AFA5596651EB71E8529790

Function 00A2E1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A2F5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00A2E1C4,?,?,?,00A2EFB7,00000000,000000EF,00000119,?,?), ref: 00A2F5BC
Part of subcall function 00A2F5AD: lstrcpyW.KERNEL32(00000000,?), ref: 00A2F5E2
Part of subcall function 00A2F5AD: lstrcmpiW.KERNEL32(00000000,?,00A2E1C4,?,?,?,00A2EFB7,00000000,000000EF,00000119,?,?), ref: 00A2F613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00A2EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00A2E1DD
lstrcpyW.KERNEL32(00000000,?), ref: 00A2E203
lstrcmpiW.KERNEL32(00000002,cdecl,?,00A2EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00A2E237

Strings

cdecl, xrefs: 00A2E22E

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 8be0fd37effe258febefff1fa73424791c520eafa143b1fddd92690dda2a2d7e
Instruction ID: 90c1be7cb85c2bea987d59f94c47d87b65c9c6066bf6fc0bcf772afb4174ef84
Opcode Fuzzy Hash: 8be0fd37effe258febefff1fa73424791c520eafa143b1fddd92690dda2a2d7e
Instruction Fuzzy Hash: B0118136100355EFCF25EF78E845ABA77B8FF85350B44413AE916CB250EB719891D7A0

Function 00A05332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A05351

Part of subcall function 009F594C: __FF_MSGBANNER.LIBCMT ref: 009F5963
Part of subcall function 009F594C: __NMSG_WRITE.LIBCMT ref: 009F596A
Part of subcall function 009F594C: RtlAllocateHeap.NTDLL(01380000,00000000,00000001,00000000,?,?,?,009F1013,?), ref: 009F598F

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: e5fd3d07b991567ef158061ef1b5ac7542281d14ce6a4c4b1a2b8ecd559229d5
Instruction ID: 410ce13baf464563a57459648dc941fa0bb8eaf600739d145b532f7fb9bdc1d9
Opcode Fuzzy Hash: e5fd3d07b991567ef158061ef1b5ac7542281d14ce6a4c4b1a2b8ecd559229d5
Instruction Fuzzy Hash: 2211C432D04A1DAECB212F70BC1576F3B98AF543A0B10442AFA049E1D0DE75C9419B51

Function 009D4531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009D4560

Part of subcall function 009D410D: _memset.LIBCMT ref: 009D418D
Part of subcall function 009D410D: _wcscpy.LIBCMT ref: 009D41E1
Part of subcall function 009D410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 009D41F1

KillTimer.USER32(?,00000001,?,?), ref: 009D45B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 009D45C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00A0D6CE

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 8c4ee47edc009fb90d2bdd16da8eab91bc91458371c703a9521513f84c2a70cf
Instruction ID: 59e72f622c92d62b1ccee3ec01b3f85ed61fc59afedf61b57bfde9b9e260bcae
Opcode Fuzzy Hash: 8c4ee47edc009fb90d2bdd16da8eab91bc91458371c703a9521513f84c2a70cf
Instruction Fuzzy Hash: 4521F671944788AFEB32CBA4EC45BE7BBECAF01308F04409EE69E56281C7755A85CB51

Function 00A4667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 009D5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00A37B20,?,?,00000000), ref: 009D5B8C
Part of subcall function 009D5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00A37B20,?,?,00000000,?,?), ref: 009D5BB0

gethostbyname.WSOCK32(?,?,?), ref: 00A466AC
WSAGetLastError.WSOCK32(00000000), ref: 00A466B7
_memmove.LIBCMT ref: 00A466E4
inet_ntoa.WSOCK32(?), ref: 00A466EF

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: b693578ad596e964f83927141f65a4044b11b3c025d16097e39960030f5b4ab4
Instruction ID: 6ef95f92ec11f88586cf4de5ba71ca4bd4047e06b944b1a370dd376d09b03f81
Opcode Fuzzy Hash: b693578ad596e964f83927141f65a4044b11b3c025d16097e39960030f5b4ab4
Instruction Fuzzy Hash: 8D115E35900509AFCB04FFA4DD86EEEB7B8BF84311B148066F502A7261DF30AE04CBA1

Function 00A29023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00A29043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A29055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A2906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A29086

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 14517d28665db17591ffd71402f98ac37c7951b099400a70e8e04ff4d745e7cd
Instruction ID: 8bc288268fc4577ae971b7fc5a352a483b060c0e1502eefb314a290d99629bae
Opcode Fuzzy Hash: 14517d28665db17591ffd71402f98ac37c7951b099400a70e8e04ff4d745e7cd
Instruction Fuzzy Hash: 1E115E79900218FFEB10DFA9CD84EDEBBB4FB48710F2040A5EA04B7250D6716E10DB90

Function 009D1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 009D2612: GetWindowLongW.USER32(?,000000EB), ref: 009D2623

DefDlgProcW.USER32(?,00000020,?), ref: 009D12D8
GetClientRect.USER32(?,?), ref: 00A0B84B
GetCursorPos.USER32(?), ref: 00A0B855
ScreenToClient.USER32(?,?), ref: 00A0B860

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 9a20cef1cf9ad1296b4c387a39ff7d1fd4cea36e035e922e9106c200dad655d3
Instruction ID: 89437f9d058d148ad54f41c5031aae184b1a0aab00d09014b15b85610ae3abca
Opcode Fuzzy Hash: 9a20cef1cf9ad1296b4c387a39ff7d1fd4cea36e035e922e9106c200dad655d3
Instruction Fuzzy Hash: 16113636A40119BFCB00EFA8D8859EE77B9FB05301F108456FA21E7250D731BA528BA5

Function 00A31652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00A301FD,?,00A31250,?,00008000), ref: 00A3166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00A301FD,?,00A31250,?,00008000), ref: 00A31694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00A301FD,?,00A31250,?,00008000), ref: 00A3169E
Sleep.KERNEL32(?,?,?,?,?,?,?,00A301FD,?,00A31250,?,00008000), ref: 00A316D1

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 8297f55b8f502b2287123b745f4b5c69a46bc5a7a15da8601cf78a8be364bcbf
Instruction ID: 3be9d56e26021b9fa28920896eb27b5d361d1151c84cdaa776f7941bd58825b0
Opcode Fuzzy Hash: 8297f55b8f502b2287123b745f4b5c69a46bc5a7a15da8601cf78a8be364bcbf
Instruction Fuzzy Hash: 53118E31C01A1CDBCF00EFE5D84AAEEBB78FF09742F044555EA44B2240CB3055608BD6

Function 00A07207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00A0722B

Part of subcall function 00A07912: __fltout2.LIBCMT ref: 00A0793B

__cftog_l.LIBCMT ref: 00A07251
__cftoe_l.LIBCMT ref: 00A07283

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 4233a72648d108932add77188761418636f1f7d1a2f131218d995278af6fe492
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: EA018C7284814EBBCF525F84EC418EE3F22BF2D340B488615FA1858071C237E9B1AB81

Function 00A5B57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00A5B59E
ScreenToClient.USER32(?,?), ref: 00A5B5B6
ScreenToClient.USER32(?,?), ref: 00A5B5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A5B5F5

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 6be4761daa14cb68e7d0f9a1531377f34f1998bd8a58c2ecfaada847a7579288
Instruction ID: 52856f2a3388a85e67f1edf57f3942a9b31bae6e7206eac31aa97a5ea444b620
Opcode Fuzzy Hash: 6be4761daa14cb68e7d0f9a1531377f34f1998bd8a58c2ecfaada847a7579288
Instruction Fuzzy Hash: 171143B9D00249EFDB41CFA9C8849EEFBB9FB18311F108166E915E3620D735AA55CF90

Function 00A5B8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A5B8FE
_memset.LIBCMT ref: 00A5B90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00A97F20,00A97F64), ref: 00A5B93C
CloseHandle.KERNEL32 ref: 00A5B94E

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 0065e4e54c869b814efdf1101a1fb22558357942a039fc8779a2eccf3887497d
Instruction ID: ce0c2e948363e53e93d6dbdac9702693372fa2b1fbdb444628f90bd3c697bcd3
Opcode Fuzzy Hash: 0065e4e54c869b814efdf1101a1fb22558357942a039fc8779a2eccf3887497d
Instruction Fuzzy Hash: 3EF054B26543147FF610A7A5AC05F7F3A9CEB09355F004022BB08E51A1DB754D01C7B8

Function 00A36E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00A36E88

Part of subcall function 00A3794E: _memset.LIBCMT ref: 00A37983

_memmove.LIBCMT ref: 00A36EAB
_memset.LIBCMT ref: 00A36EB8
LeaveCriticalSection.KERNEL32(?), ref: 00A36EC8

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: f32892067d557e1046afb84bcd8ced087b62179f59723934145f2fe6302cacc9
Instruction ID: aaa2c666d7f79daf3e24b68695ef922c7923ad9202e56fce990698d055eecd1b
Opcode Fuzzy Hash: f32892067d557e1046afb84bcd8ced087b62179f59723934145f2fe6302cacc9
Instruction Fuzzy Hash: 1EF0547A100214AFCF016F55DC85B9ABB29EF45321F08C061FE085F216CB35E911CBB4

Function 00A5C00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 009D12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009D134D
Part of subcall function 009D12F3: SelectObject.GDI32(?,00000000), ref: 009D135C
Part of subcall function 009D12F3: BeginPath.GDI32(?), ref: 009D1373
Part of subcall function 009D12F3: SelectObject.GDI32(?,00000000), ref: 009D139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00A5C030
LineTo.GDI32(00000000,?,?), ref: 00A5C03D
EndPath.GDI32(00000000), ref: 00A5C04D
StrokePath.GDI32(00000000), ref: 00A5C05B

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: bc283736d365b2df4788ad8f1621fa1dedcc21dbf0e13f223a3dea28b55f84cf
Instruction ID: 38c7ebeb6895007bc05a7db09333332dbd2ea4a8b91ee996ea1812ebf507f3a3
Opcode Fuzzy Hash: bc283736d365b2df4788ad8f1621fa1dedcc21dbf0e13f223a3dea28b55f84cf
Instruction Fuzzy Hash: 63F05E32141359BFDB12AF95AC0DFCE3F99BF05322F088011FA11610E287765656CB95

Function 00A2A37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00A2A399
GetWindowThreadProcessId.USER32(?,00000000), ref: 00A2A3AC
GetCurrentThreadId.KERNEL32 ref: 00A2A3B3
AttachThreadInput.USER32(00000000), ref: 00A2A3BA

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: b978f6c469db77b230e402d0678e314cdaec9b427749d5f8a1b7565bff53dc31
Instruction ID: 877f97a8df1a08d7423cdc1202c19a5fd2eb8f622ae44fee1d4ce9c1772cf6e1
Opcode Fuzzy Hash: b978f6c469db77b230e402d0678e314cdaec9b427749d5f8a1b7565bff53dc31
Instruction Fuzzy Hash: DFE0C931545378BBDB209BA6EC0DED77F5CFF267A2F008035F60999461C6718541DBA1

Function 009D2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 009D2231
SetTextColor.GDI32(?,000000FF), ref: 009D223B
SetBkMode.GDI32(?,00000001), ref: 009D2250
GetStockObject.GDI32(00000005), ref: 009D2258
GetWindowDC.USER32(?,00000000), ref: 00A0C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 00A0C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 00A0C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 00A0C112
GetPixel.GDI32(00000000,?,?), ref: 00A0C132
ReleaseDC.USER32(?,00000000), ref: 00A0C13D

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: af4ef810f905145ae83442efa59bdbe6a68f837daa76df9bc34158bc1ab0b1cd
Instruction ID: c557bb6718b69093657f3ac87477008a7248b3953d221323a8150b86bba5e436
Opcode Fuzzy Hash: af4ef810f905145ae83442efa59bdbe6a68f837daa76df9bc34158bc1ab0b1cd
Instruction Fuzzy Hash: 5CE03932500644EEDB219FA4FC09BD87B14FB15332F008366FBA9480E187714981DB11

Function 00A28C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00A28C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,00A2882E), ref: 00A28C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00A2882E), ref: 00A28C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,00A2882E), ref: 00A28C7E

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 0252d38d060ff988dcb91a819bc6e4206bea19335ac72ad57675dd69787a9283
Instruction ID: 50f1694054ed7e44cd531353fa11c9dcc0f9554343263cde93f1785ee2c1d694
Opcode Fuzzy Hash: 0252d38d060ff988dcb91a819bc6e4206bea19335ac72ad57675dd69787a9283
Instruction Fuzzy Hash: 04E04F766423219FD7609FF47D0CB9B3BA8BF60793F084838B645CA080EA3884428B61

Function 00A12187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00A12187
GetDC.USER32(00000000), ref: 00A12191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00A121B1
ReleaseDC.USER32(?), ref: 00A121D2

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: ee733d118afcc548328a3385060dfc2648d660978c2e0689925119274712e820
Instruction ID: 3cb3b55ed116956ed6fde89d8285ed88379a4cc4a3032f9c4db2dc0fca4963b7
Opcode Fuzzy Hash: ee733d118afcc548328a3385060dfc2648d660978c2e0689925119274712e820
Instruction Fuzzy Hash: E5E0E5B5840214EFDB019FA0C808B9DBBF1FB4C352F108426F95A97260DB3881429F40

Function 00A1219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00A1219B
GetDC.USER32(00000000), ref: 00A121A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00A121B1
ReleaseDC.USER32(?), ref: 00A121D2

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 7f40ff3364b7aee2d91bb85aa2017e5f61ad4ca8f41bce73da56cf35738434cb
Instruction ID: 146d1ca2630ce627e16ba3fb9264ba75ea6cf0773ee46916543529896a98dcbb
Opcode Fuzzy Hash: 7f40ff3364b7aee2d91bb85aa2017e5f61ad4ca8f41bce73da56cf35738434cb
Instruction Fuzzy Hash: E1E0EEB5800204AFCB01AFA0C80869EBBE1BB4C312F10842AF95AA7260EB3891429F40

Function 00A2B7B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00A2B981

Strings

AutoIt3GUI, xrefs: 00A2B8F9
Container, xrefs: 00A2B8FE

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: c6e1c81db25c5cd02d3d02aed33f4632f14242a8a96e2906e35a2885b1c9753b
Instruction ID: ab1921bb1aa834db9d8fa43ed9693e2b8729a500d0376f4510ea11b157b01764
Opcode Fuzzy Hash: c6e1c81db25c5cd02d3d02aed33f4632f14242a8a96e2906e35a2885b1c9753b
Instruction Fuzzy Hash: F4914A70610611AFDB24DF68D884B6ABBF9FF49710F14856EF94ACB691DB70E840CB60

Function 00A3B217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 009EFEC6: _wcscpy.LIBCMT ref: 009EFEE9

Part of subcall function 009D9997: __itow.LIBCMT ref: 009D99C2
Part of subcall function 009D9997: __swprintf.LIBCMT ref: 009D9A0C

__wcsnicmp.LIBCMT ref: 00A3B298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00A3B361

Strings

LPT, xrefs: 00A3B292

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 4274ca4ac82357fa0b5f919111d627227fe3c17c48ffd8b75fc9b6d89dbc546c
Instruction ID: a5b442a7bc2c893ac2b98d37d520db24059da3170174402e5616508c5d3b9fca
Opcode Fuzzy Hash: 4274ca4ac82357fa0b5f919111d627227fe3c17c48ffd8b75fc9b6d89dbc546c
Instruction Fuzzy Hash: 0C619575A10215EFCB14EF98C891EAEB7B5EF48310F11815AF646AB351DB70AE40CB60

Function 009E2AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 009E2AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 009E2AE1

Strings

@, xrefs: 009E2AD5

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 1193207fc2b7b9a8a8e5806b7ad781986478fb2d375c43fe72d814bd40f015bd
Instruction ID: 9b8af2f22e40b1a89551ee9535a0d8cbf164f266e64564af3a34ce640d4102cd
Opcode Fuzzy Hash: 1193207fc2b7b9a8a8e5806b7ad781986478fb2d375c43fe72d814bd40f015bd
Instruction Fuzzy Hash: F05127724187449BD320BF50DC86BABBBE8FBC4314F42885EF1D9911A5DB308969CB66

Function 00A399BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 009D506B: __fread_nolock.LIBCMT ref: 009D5089

_wcscmp.LIBCMT ref: 00A39AAE
_wcscmp.LIBCMT ref: 00A39AC1

Strings

FILE, xrefs: 00A399FA

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 7e6d44e86d4b8acb8255dd18bdcf6e8a1ba72a45df64f31a645ed2a5423a73a7
Instruction ID: 0fb0767387dfdc21c13ca2c944ffbad2c325c3c66c10fcbac64606ef12e8454f
Opcode Fuzzy Hash: 7e6d44e86d4b8acb8255dd18bdcf6e8a1ba72a45df64f31a645ed2a5423a73a7
Instruction Fuzzy Hash: 8641E971A40609BBDF209FA0DC45FEFBBBDDF85710F01446AF904A7281D7B59A0487A1

Function 00A42882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A42892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00A428C8

Strings

|, xrefs: 00A42899

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 2ce4b23aeb76a9f63efa9fc450ee51f921d80b4c3cb73354447a1fdad325d0d3
Instruction ID: 5e211db6b158d33341788cef237104f76ef8a516d3e98c1b0d47d48970684267
Opcode Fuzzy Hash: 2ce4b23aeb76a9f63efa9fc450ee51f921d80b4c3cb73354447a1fdad325d0d3
Instruction Fuzzy Hash: 02313D71800119AFCF01EFA1CC85EEEBFB9FF48340F10402AF815A6266EB315A56DB60

Function 00A56CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00A56D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00A56DC2

Strings

static, xrefs: 00A56D22

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: a3282ffe32ff7681d529468ecde1f1aa034669a05181b9d061e0e05a909fc50f
Instruction ID: 8d20153707cf0dfff000951104ac877776e7402c01386d8f57c7ecb31573f1a7
Opcode Fuzzy Hash: a3282ffe32ff7681d529468ecde1f1aa034669a05181b9d061e0e05a909fc50f
Instruction Fuzzy Hash: FE317E72210604AEDB10DF64CC80BFB77B9FF48721F549A19FDA597190DA31AC95CB60

Function 00A32D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A32E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00A32E3B

Strings

0, xrefs: 00A32DF9

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 9ada1fe895fcab172315040f5e66f83380721b29213d2f43ec8e5bc958ea7c0f
Instruction ID: 2537b90cba62d6ebd4b95fd77e52d8b0a4b2ee4bdd46c6d8bb186113a42b29bb
Opcode Fuzzy Hash: 9ada1fe895fcab172315040f5e66f83380721b29213d2f43ec8e5bc958ea7c0f
Instruction Fuzzy Hash: 7A31E631600309EBEB24CF58C846BAEBFB9FF45350F24402AF985961A0E7709940CB50

Function 00A56943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00A569D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A569DB

Strings

Combobox, xrefs: 00A5699D

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 24db517529602a49eecff0efd5706ba85a00b2814cf43ea8259978fa4c423456
Instruction ID: cdeeb591d2372066ed9633c77bbc8f9d40daba8c159d38f9c7e2d98399fa27b5
Opcode Fuzzy Hash: 24db517529602a49eecff0efd5706ba85a00b2814cf43ea8259978fa4c423456
Instruction Fuzzy Hash: E111BF71700208BFEF119F64CC80EEB3BAAFB993A5F514125FD589B2A0D6719C558BA0

Function 00A56E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 009D1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 009D1D73
Part of subcall function 009D1D35: GetStockObject.GDI32(00000011), ref: 009D1D87
Part of subcall function 009D1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 009D1D91

GetWindowRect.USER32(00000000,?), ref: 00A56EE0
GetSysColor.USER32(00000012), ref: 00A56EFA

Strings

static, xrefs: 00A56EBD

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 29a1e4482dbc2308f1292d786d65e3051904012408be4205594534a1b51017eb
Instruction ID: c9dde7f11a177af086bb6150d4b3e2c542b3dda15e951ab060fc3a67249ea347
Opcode Fuzzy Hash: 29a1e4482dbc2308f1292d786d65e3051904012408be4205594534a1b51017eb
Instruction Fuzzy Hash: FF212972A10209AFDB04DFA8DD45AEA7BB8FB08315F044629FD55D3250E734E865DB60

Function 00A56B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00A56C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00A56C20

Strings

edit, xrefs: 00A56BF5

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: bb84b9c78df73427a7bc6408cbc6375f51e1be070c26b48230954ffcf10f1bb9
Instruction ID: 85cd02654d8a10b8b72d8a2f73ac6ba50eff56f8ef722a3888f0409e21942be2
Opcode Fuzzy Hash: bb84b9c78df73427a7bc6408cbc6375f51e1be070c26b48230954ffcf10f1bb9
Instruction Fuzzy Hash: C6116A71541208AFEB108FA49C41AAB376AFB0437AFA14724FD61D71E0C775EC999B60

Function 00A32E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A32F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00A32F30

Strings

0, xrefs: 00A32F07

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 3f6248dfa4fa7b0c3de7d9d6ee0d878e57cf6b1511763318ff1379d0dd9471a7
Instruction ID: b3ddc28f54d1851a940658baf305b950decc5eb1307cade2b0a1a4e53652e36c
Opcode Fuzzy Hash: 3f6248dfa4fa7b0c3de7d9d6ee0d878e57cf6b1511763318ff1379d0dd9471a7
Instruction Fuzzy Hash: 7411C431A01214ABDB21DB98DC46BA977B9EF05350F1880B6F854A72A0DBB0EE15C791

Function 00A424CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00A42520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00A42549

Strings

<local>, xrefs: 00A42511

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: ce0ca4cefd2ea91b44e9bd36c5f995522b236e15334af927c0f3619faf67b124
Instruction ID: af568ca815e0e8f22479adb7e4d5f75b7aeecf4ac4ef87752d9f3c80afc7094c
Opcode Fuzzy Hash: ce0ca4cefd2ea91b44e9bd36c5f995522b236e15334af927c0f3619faf67b124
Instruction Fuzzy Hash: 2711E078501225BEEB249F518C98FBBFF68FF46351F50812AF90543040D2B46981DBF1

Function 00A480A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A4830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00A480C8,?,00000000,?,?), ref: 00A48322

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00A480CB
htons.WSOCK32(00000000,?,00000000), ref: 00A48108

Strings

255.255.255.255, xrefs: 00A480E3

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: d3cda2aee0a06a177aefd9033dbbdec43cff30eab2cc95b3a8c594d8cd7cf8a1
Instruction ID: 1cb9ff03f617557be59fbdeb9f453aa634b324b3ede1347cc141b710938dbe39
Opcode Fuzzy Hash: d3cda2aee0a06a177aefd9033dbbdec43cff30eab2cc95b3a8c594d8cd7cf8a1
Instruction Fuzzy Hash: 6B11E538100305ABDB20EF68DC46FADB334FF84310F108627E91197291DB71A811C755

Function 00A292E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D7F41: _memmove.LIBCMT ref: 009D7F82

Part of subcall function 00A2B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00A2B0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00A29355

Strings

ComboBox, xrefs: 00A292F4
ListBox, xrefs: 00A2931F

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 2741e868a57320323be63fb796cbbc596801224678df78f6436f9eba2b366478
Instruction ID: 77a38f1de3aa080b3951c92a17144dc174ccd48e60949277b9a25e87af393be4
Opcode Fuzzy Hash: 2741e868a57320323be63fb796cbbc596801224678df78f6436f9eba2b366478
Instruction Fuzzy Hash: D601F571A45224ABCB04FBA8CC919FF7369BF46320B140629F8325B3D1DB31580C8760

Function 00A291DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D7F41: _memmove.LIBCMT ref: 009D7F82

Part of subcall function 00A2B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00A2B0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 00A2924D

Strings

ComboBox, xrefs: 00A291EC
ListBox, xrefs: 00A29217

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 472c07d6e3107d3c6a7e5e98bda8cd3ec52e2a3ec319a88796b50453cd956dc3
Instruction ID: aa9186b89e2031bfc470dd3f42934b1c6f403ad047b04c28800869a261b515fa
Opcode Fuzzy Hash: 472c07d6e3107d3c6a7e5e98bda8cd3ec52e2a3ec319a88796b50453cd956dc3
Instruction Fuzzy Hash: 4901A771A85215BBCB19EBA4D992EFF73ACAF45740F14002AB91267281EB115F0C9771

Function 00A29264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D7F41: _memmove.LIBCMT ref: 009D7F82

Part of subcall function 00A2B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00A2B0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 00A292D0

Strings

ComboBox, xrefs: 00A29271
ListBox, xrefs: 00A2929C

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: c882087bbd5054478a3f658c4406dadd9fb749022d2d0d34b37c922c74f46fc0
Instruction ID: cc72ad458fd5d205c0b54bc6feaae8cf1de30f552aa20ad1b80ffc36af3df239
Opcode Fuzzy Hash: c882087bbd5054478a3f658c4406dadd9fb749022d2d0d34b37c922c74f46fc0
Instruction Fuzzy Hash: 7801DB71A85215B7CB15F7A8D982FFF77AC9F15740F244126781263281DB215F0C9371

Function 00A351CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00A351E8
_wcscmp.LIBCMT ref: 00A351FA

Strings

#32770, xrefs: 00A351F4

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: ca554417f4e9c2bfb4fadb7038d4a5f348830fa083b9f53816e9a3d1d4d7d933
Instruction ID: b811a41fcf3fe2e7ec88292bedb660889ecbd8983516f76c5537fc95d1d5e76a
Opcode Fuzzy Hash: ca554417f4e9c2bfb4fadb7038d4a5f348830fa083b9f53816e9a3d1d4d7d933
Instruction Fuzzy Hash: 11E02232A0022C2AE320EAE9AC49BA7F7ACFB45721F00016BF910D3050E5609A058BE0

Function 00A281BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00A281CA

Part of subcall function 009F3598: _doexit.LIBCMT ref: 009F35A2

Strings

AutoIt, xrefs: 00A281BE
Error allocating memory., xrefs: 00A281C3

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: ad93e15f8d5403e64e0018d611523059309f7537c4bd26c252381ab85338119f
Instruction ID: 3d75571e2f2abdb652750eaef2e7685460110241005da9e3aa337451235cec39
Opcode Fuzzy Hash: ad93e15f8d5403e64e0018d611523059309f7537c4bd26c252381ab85338119f
Instruction Fuzzy Hash: C6D05B323C535C36D31433E86C07FDA79485B55B56F044426BB08555D38DE5559243D9

Function 00A0B511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00A0B564: _memset.LIBCMT ref: 00A0B571

Part of subcall function 009F0B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00A0B540,?,?,?,009D100A), ref: 009F0B89

IsDebuggerPresent.KERNEL32(?,?,?,009D100A), ref: 00A0B544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,009D100A), ref: 00A0B553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00A0B54E

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 33a6b7910fc5723243397f4da01f128130b0419bbd82d6d9c0a34b67a522aad4
Instruction ID: bd3c8896c822ea37dcfba6ff9d0eb3514b142b835b450c21567d4d357b1a27e1
Opcode Fuzzy Hash: 33a6b7910fc5723243397f4da01f128130b0419bbd82d6d9c0a34b67a522aad4
Instruction Fuzzy Hash: A1E06DB06107148FD720DF68EA043467BE4BF00755F00C96DE446C7791EBB4E405CB61

Function 00A55BEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A55BF5
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00A55C08

Part of subcall function 00A354E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A3555E

Strings

Shell_TrayWnd, xrefs: 00A55BEE

Memory Dump Source

Source File: 00000000.00000002.1648828579.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1648815145.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1648895588.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649025101.0000000000A8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1649045595.0000000000A98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_arrival notice.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: f6d751d733b5f19a0c19cfd7bd02980f4aa37f5750443f20f80a023f902ecc5a
Instruction ID: f7478a0157076257f5a1357bebf67ecc67134799bbdb1685a20eb29f387aeb68
Opcode Fuzzy Hash: f6d751d733b5f19a0c19cfd7bd02980f4aa37f5750443f20f80a023f902ecc5a
Instruction Fuzzy Hash: E1D0C931798311BBE768BBB0AD4FF976A14BB10B52F040825B745AA1D0D9F45801C654

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report arrival notice.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\acrorrheuma

C:\Users\user\AppData\Local\Temp\aut8EEC.tmp

C:\Users\user\AppData\Local\Temp\aut8F4B.tmp

C:\Users\user\AppData\Local\Temp\selectee

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
arrival notice.exe

Function 009D3B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 009D4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 009D4FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00A393DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 009D3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 69
windowregistryCOMMON

Function 009D3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 009D71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 009D3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 009D3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 009D3778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 009925D0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 009D39E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 009923B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 142
fileCOMMON

Function 009D410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 009F564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre